Google has released Chrome 100.0.4896.127 for Windows, Mac, and Linux, to fix a high-severity zero-day vulnerability actively used by threat actors in attacks.
"Google is aware that an exploit for CVE-2022-1364 exists in the wild," Google said in a security advisory released today.
While Google states that this Chrome update will roll out over the next few days/weeks, users can receive it immediately by going into the Chrome menu > Help > About Google Chrome.
The browser will also automatically check for new updates and install them the next time you close and relaunch Google Chrome.
As this bug is actively exploited in attacks, it is strongly advised that you perform a manual check for new updates and relaunch the browser to apply them.
Few details disclosed
The zero-day bug fixed today is tracked as CVE-2022-1364 and is a high severity type confusion weakness in the Chrome V8 JavaScript engine.
While type confusion flaws generally lead to browser crashes following successful exploitation by reading or writing memory out of buffer bounds, attackers can also exploit them to execute arbitrary code.
This vulnerability was discovered by Clément Lecigne from Google's Threat Analysis Group who reported it to the Google Chrome team yesterday.
While Google said they have detected attacks exploiting this zero-day, it did not provide further details regarding how these attacks are conducted.
"Access to bug details and links may be kept restricted until a majority of users are updated with a fix," Google added.
This is the only vulnerability disclosed in this update, indicating that Chrome 100.0.4896.127 was pushed out as an emergency update to resolve this issue.
Third Chome zero-day fixed this year
With this update, Google has addressed the third Chrome zero-day since the start of 2022.
The previous two vulnerabilities found in 2022 are listed below.
- CVE-2022-1096 - March 25th
- CVE-2022-0609 - February 14th
As this zero-day is known to be used in attacks, it is strongly advised to update Google Chrome as soon as possible.
Comments
opengears - 2 years ago
I have written about issues with Google's JavaScript engine, and have outlined other options such as Firefox and Librewolf. You can read the blog post here https://medium.com/codex/mozilla-firefox-and-chromium-in-the-new-threat-landscape-electron-browser-security-forks-and-cbf8de716dfd
INTREPID-FL - 2 years ago
There is an error in this story. Google said the update will automatically roll out in the coming days, not weeks.
https://chromereleases.googleblog.com/2022/04/stable-channel-update-for-desktop_14.html
Lawrence Abrams - 2 years ago
Actually said both: "will roll out over the coming days/weeks."
However, I have clarified that in the story.