Google releases one other emergency safety replace for Chrome

Last updated: 2024/03/09 at 12:56 AM

a.ade

It is time to replace Google Chrome once more. Google simply launched an emergency safety replace for its Chrome net browser that fixes a safety challenge exploited within the wild.

The replace is obtainable for desktop variations of Google Chrome and for Chrome on Android. Customers are suggested to replace as quickly as doable to guard their gadgets from potential assaults concentrating on these vulnerabilities.

Chrome Desktop customers can load chrome://settings/assist instantly within the tackle bar or choose Menu > Assist > About Google Chrome to view the put in model. The browser runs an replace verify when the web page is opened to obtain the most recent replace it finds. A browser restart is required to finish the method. On Android, updates are managed by Google Play.

As soon as up to date, the next variations needs to be listed on the About Google Chrome web page:

Google Chrome for Home windows: 112.0.5615.137 or 112.0.5615.138
Google Chrome for Mac or Linux: 112.0.5615.137
Google Chrome for Android: 112.0.5615.135 or 112.0.5615.136

Google Chrome 112: safety replace

Google lists 5 of the eight safety points mounted within the newest Google Chrome replace on the official web site. Chrome Variations Weblog. Details about safety points detected internally shouldn’t be disclosed to the general public.

The 5 safety points embody the difficulty that’s exploited within the wild. Right here is the itemizing:

($8,000)(1429197) Excessive CVE-2023-2133: Out-of-bounds reminiscence entry in Service Employee API. Reported by Rong Jian of VRI on 03/30/2023
($8,000)(1429201) Excessive CVE-2023-2134: Out of bounds reminiscence entry in Service Employee API. Reported by Rong Jian of VRI on 03/30/2023
($3,000) (1424337) Excessive CVE-2023-2135: Free use in DevTools. Reported by Cassidy Kim (@cassidy6564) on 03/14/2023
($NA)(1432603) Excessive CVE-2023-2136: Integer overflow in Skia. Reported by Clément Lecigne of the Google Risk Evaluation Group on 04/12/2023
($1,000) (1430644) Medium CVE-2023-2137: Heap buffer overflow in SQLite. Reported by Nan Wang (@eternalsakura13) and Guang Gong of the 360 Vulnerability Analysis Institute on 04/05/2023

Exterior safety researchers obtain bug bounty after they report safety points to Google and different browser builders.

CVE-2023-2136 safety challenge is being exploited wildly, in response to Google. Public data is proscribed at this level, however Skia is referring to a part of Chrome that’s answerable for “practically all graphics operations, together with textual content rendering,” in response to the Chrome design docs.

Customers working different Chromium-based net browsers ought to take note of updates to their browsers, as these are additionally affected by the safety challenge. Anticipate updates for Edge, Courageous, and different browsers quickly.

The safety replace is the second replace for Chrome 112 that fixes a safety challenge exploited within the wild. THE earlier replace was launched on April 15, 2023.

Abstract