Google has updated its Chrome web browser, fixing four bugs with a severity rating of “high” and eight overall. Three are use-after-free flaws, which could allow an adversary to generate an error in the browser’s memory, opening the door to a browser hack and host computer compromise.
On Friday, the Cybersecurity and Infrastructure Security Agency (CISA) issued a security bulletin urging users and infosec administrators to apply the update. The agency warned that the vulnerabilities can be used by an attacker “to take control of an affected system.”
According to Google’s December security bulletin, previous Windows, macOS and Linux versions of the Chrome desktop browser are vulnerable to attacks. An updated 87.0.4280.88 version of Chrome addresses the bugs and will “roll out over the coming days/weeks,” Google wrote.
How to Manually Update Your Chrome Browser
To manually update your Chrome browser, visit Chrome’s customization drop-down menu in the upper-right hand side of the client. From that menu select “Help” and then “About Google Chrome.” Opening that menu item automatically triggers Chrome to look for updates.
Details tied to each of the bugs are being withheld at this time, Google said, “until a majority of users are updated with a fix.” It also noted that when and if bugs exist in third-party code libraries used in other devices or platforms, technical details of the bugs will be limited.
Bug Breakdowns: Unique Linux Flaw
Three high-severity bugs each include use-after-free elements impacting memory, tied to Chrome’s clipboard, media and extensions components. The bugs are tracked as CVE-2020-16037, CVE-2020-16038 and CVE-2020-16039.
The fourth high-severity bug (CVE-2020-16040) impacts Google’s open-source and high-performance JavaScript and WebAssembly engine, called V8. The bug is identified as an insufficient-data-validation flaw, which in some cases opens targets to cross-site scripting attacks.
Google’s V8 JavaScript engine also received a second patch this month — one of two medium-severity bugs reported this December. Tracked as CVE-2020-16042, that issue is identified as an “uninitialized-use” bug impacting V8. It’s unclear from Google’s bulletin the exact nature of the flaw. But cybersecurity researchers have described these types of uninitialized-use bugs as “largely overlooked” and often “regarded as insignificant memory errors.”
“[These] are actually a critical attack vector that can be reliably exploited by hackers to launch privilege-escalation attacks in the Linux kernel,” according to 2017 research published by the Georgia Institute of Technology.
A second medium-severity bug (CVE-2020-16041) is an “out-of-bounds read in networking” vulnerability. This could allow an adversary to improperly access objects in memory. While technical details of the CVE are also being withheld, this type of vulnerability could allow an unauthenticated adversary to send a malformed message to vulnerable software. Due to insufficient validation of the message, the targeted program could be forced to crash.
Google acknowledged several security researchers that contributed to identifying this month’s bugs. Ryoya Tsukasaki was thanked for finding the use-after-free bug (CVE-2020-16037) in the Chrome clipboard, which earned the researcher a $5,000 bug bounty. Khalil Zhani, Lucas Pinheiro, Sergei Glazunov, André Bargull and Mark Brand were also credited for their bug-hunting efforts.
Put Ransomware on the Run: Save your spot for “What’s Next for Ransomware,” a FREE Threatpost webinar on Dec. 16 at 2 p.m. ET. Find out what’s coming in the ransomware world and how to fight back.
Get the latest from John (Austin) Merritt, Cyber Threat Intelligence Analyst at Digital Shadows, and Israel Barak, CISO at Cybereason, on new kinds of attacks. Topics will include the most dangerous ransomware threat actors, their evolving TTPs and what your organization needs to do to get ahead of the next, inevitable ransomware attack. Register here for the Wed., Dec. 16 for this LIVE webinar.
