Details have emerged about a critical security vulnerability in the implementation of recently corrected remote code in google Chrome's JavaScript and WebAssembly V8 engine and Chromium-based browsers.
the problem relates to the status of subsequent use in the help improvement component, and successful exploitation may "allow the attacker to perform random code in the browser context."
The bug, identified in the Dev channel version of Chrome 101, was reported to Google by Weibo Wang, a security researcher at Singapore's cybersecurity company Numen Cyber Technology and has since been quietly repaired by the company.
"this vulnerability occurs at the instruction selection stage, where the wrong instructions have been chosen and lead to an exception in memory access," wang said.
defects of subsequent use occur when you access previously edited memory, resulting in unspecified behavior, causing software failure, using damaged data, or even executing random code.
what is even more disturbing is that the bug can be exploited remotely via a website specifically designed to bypass security restrictions and run random code to breach targeted systems.
Wang explained: "This vulnerability can be exploited more using Heap spraying techniques, thereby weakening the type confusion type confusion." "The vulnerability allows the attacker to control job indicators or write code in random locations in memory, and eventually leads to code execution."
The company has not yet revealed the vulnerability through the Chromium bug tracker portal to give as many users as possible to install the corrected version first. Also, Google doesn't allocate CVE IDs to vulnerabilities in unstable Chrome channels.
Chrome users, especially developers who use the Dev version of Chrome for testing to make sure their apps are compatible with chrome's latest features and API changes, should update to the latest available version of the software.
Comments
Post a Comment