Google Patches Severe Chrome Browser Zero-Day Exploit, Update Now
Google noted this week that it had patched a zero-day bug inside the Chrome browser that had to do with its V8 JavaScript engine. The V8 JavaScript Engine is open-source, and the flaw in Chrome impacted the versions of the browser for Windows, macOS, and Linux.
The bug is tracked as CVE-2020-6418, and it has a severity rating of high. Google noted that the flaw impacts versions of Chrome that were released before 80.0.3987.122. Technical details of the bug are being withheld until the flaw has been fully patched, according to Google. ThreatPost, however, says that memory corruption vulnerabilities happen when memory is altered without explicit data assignments, triggering programming errors.
Those programming errors allow attackers to execute code on the targeted device. The bug was being actively exploited in the wild before Google issued the patch this week. Since the technical details of the bug haven't been released at this time, we aren't exactly sure how it was being exploited. However, ThreatPost notes that a similar corruption bug exploited earlier this month allowed a specially crafted website to use the exploit to execute code remotely.
The person who discovered the CVE-2020-6418 bug was Google Threat Analysis Group researcher Clement Lecigne. Google is also issuing warnings to Chrome users of a pair of other vulnerabilities that are rated with a high severity. One of the vulnerabilities is tracked as CVE-2020-6407 and is an "out of bounds memory access in streams" bug. The other hasn't been assigned a CVE tracking number but is tied to an integer overflow in ICU. That type of flaw is often associated with triggering a denial of service and possibly for code execution.
