Google releases emergency patch for Chrome browser

Google has just released an unscheduled update to address a zero-day vulnerability that is believed to be actively exploited by hackers in the Google Chrome browser. This is the first serious bug of 2023 in the world's largest browser.

The vulnerability, identified as CVE-2023-2033, was reported by Clement Lecigne of Google's Threat Analysis Group (TAG) on April 11, 2023. Google TAG is a team of experts tasked with discovering and reporting zero-day vulnerabilities exploited in highly targeted attacks by state- sponsored threat actors.

The vulnerability, described as a high severity issue in the V8 JavaScript engine, is a type confusion issue in V8 in Google Chrome browser before version 112.0.5615.121 that allows a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Users need to update Chrome browser immediately

While the bug typically allows attackers to cause browser crashes by successfully reading or writing out-of-bounds buffer data, it can also allow hackers to execute code on compromised devices. The high severity of the vulnerability has led Google to say that access to details of the bug will be limited until most users are patched.

It is also possible that Google will continue to restrict access to this security flaw as it is also present in third-party libraries or projects that depend on JavaScript V8 and have not been patched.

Users of Chromium-based browsers like Microsoft Edge, Brave, Opera, and Vivaldi should also apply the fixes as soon as they are released. To check the new version of Google Chrome, from your browser, go to Chrome > Help > About Google Chrome.

Source link: https://thanhnien.vn/google-tung-ban-va-khan-cap-cho-trinh-duyet-chrome-185230416221118396.htm