Google Chrome Zero-Day Cyber Alert

Key Takeaways

  • Active Exploitation Warning: Google Chrome users must update to version 112.0.5615.121 immediately because a zero-day flaw is currently being exploited in the wild.
  • Critical Vulnerability: The issue (CVE-2023-2033) is a “Type Confusion” bug in the V8 JavaScript engine that allows hackers to corrupt memory and execute malicious code.
  • Emergency Patch: Google released this “out-of-band” update specifically to fix this severe security gap outside of the normal update schedule.
  • Affected Systems: The update applies to Windows, macOS, and Linux users, all of whom are at risk until the patch is applied.

In today’s SensCy Cyber Alert, your SensCy team recommends Google Chrome Browser users to install the new Chrome Version immediately. Prompt action is required to protect your systems against critical Google Chrome vulnerabilities.

Google Chrome released an out-of-band update to resolve a Google Chrome Zero-Day Vulnerability that is currently exploited in the wild. The vulnerability can be tracked as CVE-2023-2033 and is described as a type confusion issue in the JavaScript engine. Unlike minor bugs, this ranks among the most severe Google Chrome vulnerabilities because attackers are already using it to compromise systems.

“Type confusion in V8 in Google Chrome prior to 112.0.5615.121 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page,” according to the NIST’s National Vulnerability Database (NVD).

Users are recommended to upgrade to version 112.0.5615.121 for Windows, macOS, and Linux to mitigate potential threats associated with these Google Chrome vulnerabilities.

How to check for new updates:

For new Google Chrome updates, follow these steps:

  1. On your computer, open Chrome.
  2. At the top right, click the ellipsis (…).
  3. Click Help and then About Google Chrome.
  4. Click Update Google Chrome.

Important: If your Chrome browser is up-to-date, you will see a blue check mark and the words “Chrome is up to date.”

Frequently Asked Questions (FAQ)

1. What makes a “Zero-Day” vulnerability different from others?

A “Zero-Day” vulnerability means the security flaw was discovered by attackers before the software vendor (Google) knew about it or had a fix ready. The term “zero-day” implies the developers had zero days to fix it before it could be exploited. This makes it highly dangerous because no defense existed until the patch was released.

2. What is an “out-of-band” update?

Most software updates follow a schedule (e.g., “Patch Tuesday”). An “out-of-band” update is an emergency release issued unexpectedly to fix an urgent problem. Because CVE-2023-2033 is being exploited in the wild, Google did not wait for the next scheduled release to fix it.

3. What is “Type Confusion” in the V8 Engine?

The V8 engine is what Chrome uses to process JavaScript code on websites. “Type Confusion” happens when the engine gets confused about what kind of data it is handling (e.g., thinking a number is a memory address). Attackers can use this confusion to trick the browser into running malicious code or crashing the system.

4. If I have auto-updates on, am I safe?

Usually, yes, but not instantly. Chrome downloads updates in the background, but they don’t install until you restart the browser. If you tend to leave your browser open for days or weeks at a time, you are still vulnerable even if the update has been downloaded. You must restart Chrome to apply the fix.

If you need additional assistance, use this Google Chrome link.

For more cyber briefs and alerts, visit https://senscy.com/cyber-briefs/.