Saturday, July 13, 2024

Hackers Actively Exploited A Critical Chrome 0-Day Vulnerability In Wide – Update Your Chrome Now!!

Recently, to fix four new vulnerabilities Google updated its Chrome browser to the new version, “91.0.4472.114.” Among those four vulnerabilities, the security experts identified a critical 0-day vulnerability that is being exploited widely by hackers.

The security researchers have marked the 0-day flaw as CVE-2021-30554, and this is the second Chrome 0-day flaw that is patched by Google this month, while this year it’s the seventh one that’s being exploited before patching.

While this Chrome 0-Day vulnerability CVE-2021-30554 was actually reported by an anonymous user, and that’s why the bug reward for this bug also remains undisclosed.

Flaws Detected

Along with the 0-Day vulnerability, in this release, the developers have also fixed three more use-after-free problems in Chrome Sharing, WebAudio, and TabGroups. And below we have mentioned the bug identifiers:-

  • CVE-2021-30554 (High Severity) (0-Day flaw)
  • CVE-2021-30555 (High Severity)
  • CVE-2021-30556 (High Severity)
  • CVE-2021-30557 (High Severity)

No Key Details

This new zero-day vulnerability (CVE-2021-30554) exists in WebGL, and it’s a post-release vulnerability. In short, this 0-day vulnerability is a use-after-free in the Web Graphics Library (WebGL) JavaScript API that is used to render interactive 2D and 3D graphics without using plugins by Chrome.

Experts at Google have claimed that an attack program targeting this Chrome 0-Day vulnerability has already been circulated in the wild. 

However, for now, being Google has not yet disclosed any key details of this vulnerability, and allowed access to it only to specific researchers in order to allow users time to implement the patches.

Google stated that “Access to the information about these vulnerabilities will be restricted until the maximum numbers of users are updating their old Chrome browser. But, if a bug exists in a third-party library that other projects depend on in a similar way, and it has not yet been fixed, then definitely we can stick to the alike restrictions.”

Apart from this, the successful exploitation of this flaw may lead to the execution of arbitrary code on the computers of users with vulnerable versions of the Chrome browser.

Previously Fixed Flaws

The flaws that are previously fixed by Google are mentioned below:-

  • CVE-2021-21148
  • CVE-2021-21166
  • CVE-2021-21193
  • CVE-2021-21220
  • CVE-2021-21224
  • CVE-2021-30551

Moreover, Google has claimed that they are already aware of CVE-2021-30554 attacks, but, the company traditionally does not provide any information about these incidents.

But, the security analysts have strongly recommended all the users to update their Google Chrome to the latest version to mitigate these threats.

Google Chrome will automatically upgrade the browser when you launch the program, You can perform a manual update by going to Settings > Help > ‘About Google Chrome.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

mSpy Data Breach: Millions of Customers’ Data Exposed

mSpy, a widely used phone spyware application, has suffered a significant data breach, exposing...

Advance Auto Parts Cyber Attack: Over 2 Million Users Data Exposed

RALEIGH, NC—Advance Stores Company, Incorporated, a prominent commercial entity in the automotive industry, has...

Hackers Using ClickFix Social Engineering Tactics to Deploy Malware

Cybersecurity researchers at McAfee Labs have uncovered a sophisticated new method of malware delivery,...

Coyote Banking Trojan Attacking Windows Users To Steal Login Details

Hackers use Banking Trojans to steal sensitive financial information. These Trojans can also intercept...

Hackers Created 700+ Fake Domains to Sell Olympic Games Tickets

As the world eagerly anticipates the Olympic Games Paris 2024, a cybersecurity threat has...

Japanese Space Agency Spotted zero-day via Microsoft 365 Services

The Japan Aerospace Exploration Agency (JAXA) has revealed details of a cybersecurity incident that...

Top 10 Active Directory Management Tools – 2024

Active Directory Management Tools are essential for IT administrators to manage and secure Active...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles