Google Chrome Vulnerabilities

Key Takeaways

  • Immediate Update Required: Google Chrome users need to update to version 130 immediately to fix two specific security flaws.
  • Critical Vulnerabilities Patched: The update resolves a Critical “out-of-bounds write” in WebGPU and a High-severity “use-after-free” in WebRTC.
  • Code Execution Risk: While no active attacks are confirmed, these flaws could theoretically allow hackers to run malicious code on your computer.
  • Target Versions: Secure your browser by updating to version 130.0.6723.91/.92 for Windows/Mac and 130.0.6723.91 for Linux.

Google Chrome Vulnerabilities: Version 130 Security Patch

In today’s SensCy Cyber Alert, your SensCy team recommends Google Chrome Browser users to install the new Chrome Version immediately. The new update includes patches for 2 vulnerabilities effectively mitigating risks associated with known Google Chrome vulnerabilities.

The Google Chrome 130 release includes patches for two vulnerabilities: a critical out-of-bounds write (CVE-2024-10487) in Dawn, the WebGPU implementation, and a high-severity use-after-free (CVE-2024-10488) in WebRTC. This release targets severe Google Chrome vulnerabilities found in the browser’s core rendering and communication components.

CVE-2024-10487, reported by Apple’s SEAR team, may affect Firefox and Safari, but this is unconfirmed. While the impact of CVE-2024-10487 is unclear, such flaws can allow arbitrary code execution. Proactive management of Google Chrome vulnerabilities helps avoid these risks. Currently, no in-the-wild exploitation has been reported.

Below are the new available updates to fix these Google Chrome vulnerabilities:

  • Windows and Mac: Chrome prior to 130.0.6723.91/.92
  • Linux: Chrome prior to 130.0.6723.91

How to check for new updates:

For new Google Chrome updates, follow these steps:

  1. On your computer, open Chrome.
  2. At the top right, click the ellipsis (…).
  3. Click Help and then About Google Chrome.
  4. Click Update Google Chrome.

Important: If your Chrome browser is up-to-date, you will see a blue check mark and the words “Chrome is up to date.”

Frequently Asked Questions (FAQ)

1. What is an “Out-of-Bounds Write” (CVE-2024-10487)?

An out-of-bounds write occurs when a program writes data past the end (or before the beginning) of the intended buffer or memory area. This can corrupt data, crash the program, or, in critical cases like this one, allow an attacker to write malicious code into memory and execute it.

2. What is WebRTC and why does it matter?

WebRTC (Web Real-Time Communication) is the technology that allows audio and video communication to work inside web pages without installing plugins (used in apps like Google Meet or Zoom). A vulnerability here (CVE-2024-10488) is significant because it affects how the browser handles real-time data streams.

3. Are these vulnerabilities being used by hackers right now?

The report states that “no in-the-wild exploitation has been reported.” This means security researchers found the flaws before hackers started using them widely. However, now that the flaws are public, it is vital to update before hackers develop tools to exploit them.

4. Why does an Apple team report bugs for Google Chrome?

Security research is often collaborative. Apple’s SEAR (Security Engineering and Architecture) team likely discovered the flaw while testing WebGPU standards that are shared or similar across different browsers (like Safari and Chrome). Reporting these issues helps secure the entire web ecosystem.

If you need additional assistance, use this Google Chrome link.