New Security Flaws found in Google Chrome Browser – Update now!

 

An urgent and important software update was released by Google for their Chrome web browser and it is crucial that all users upgrade to the latest available version as soon as possible.

 

The new version – Chrome 77.0.3865.90, is available to users worldwide from Wednesday and it contains security patches for 1 critical and 3 high-risk security vulnerabilities. The most severe could allow remote hackers to take control of an affected system.

To prevent hackers as well as to give users sufficient time to update their Google Chrome to the latest version, Google has decided to withhold the information of the four vulnerabilities for a few more days.

 

Use After Free specifically refers to the attempt to access memory after it has been freed, which can cause a program to crash or, in the case of a Use-After-Free flaw, can potentially result in the execution of arbitrary code or even enable full remote code execution capabilities.

For now, Chrome security team has only revealed that all four vulnerabilities are use-after-free issues in different components of the web browser, as mentioned below, the critical of which could lead to remote code execution attacks.

 

Faults corrected by Chrome 77.0.3865.90

 

• Use-after-free in UI (CVE-2019-13685) — Reported by Khalil Zhani
• Use-after-free in media (CVE-2019-13688) — Reported by Man Yue Mo of Semmle Security Research Team
• Use-after-free in media (CVE-2019-13687) — Reported by Man Yue Mo of Semmle Security Research Team
• Use-after-free in offline pages (CVE-2019-13686) — Reported by Brendon Tiszka

 

Google has paid out a total of $40,000 in rewards to Man Yue Mo of Semmle for both the vulnerabilities—$20,000 for CVE-2019-13687 and $20,000 for CVE-2019-13688—while the bug bounties for the remaining two vulnerabilities are yet to be decided.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser just by convincing victims into just opening, or redirecting them to, a specially-crafted web-page on the affected Chrome browser, without requiring any further interaction.

 

Based on previous discloses, the use-after-free flaw could also lead to sensitive information disclosure, security restrictions bypass, unauthorized actions, and cause denial-of-service conditions—depending on the privileges associated with the application.

 

Even though Google Chrome automatically alerts users about the latest available version, it is strongly suggested to check and set off the update process by going to “Help → About Google Chrome” from the menu to ensure that you have the latest version.