Thursday, July 18, 2024

Google Fixed yet Another Actively Exploited zero-day Vulnerability in the Chrome Browser

Once again Google has fixed another Zero-day vulnerability in the Chrome browser, and this is the second vulnerability that has been recently fixed by Google. 

However, Google has dispatched the new version “89.0.4389.90” on Friday for all the major platforms (Windows, Mac, and Linux), which is expected to come out in a few days/weeks to all users.

As per the record, this new update includes a total of five security fixes, and the most significant flaw among all is being amended by Google. Here are the flaws that were fixed by the external researchers:-

  • CVE-2021-21191 (High Severity)
  • CVE-2021-21192 (High Severity)
  • CVE-2021-21193 (High Severity)

This flaw affects usage after free vulnerability in its Blink rendering engine, that’s why Google has labeled the bug as CVE-2021-21193.

No further Information About these Continuing Attacks

It is not yet clear that which researchers have detected this vulnerability, and that’s why it’s named under Google. Google has described the vulnerability and proclaimed that it is used as a free bug in Blink.

Moreover, it is an open-source browser rendering engine generated by the Chromium project along with different participation from Google, Facebook, Microsoft, and many others.

The analyst of Google affirmed that every Chrome user should spend more time installing the security update that is operating out over the subsequent days so that it will prevent further exploitation.

Applicable Platforms and Common Consequences

Google has listed all the possible areas in which all the given weaknesses could appear, and here they are mentioned below:-

  • Languages
  • Operating Systems
  • Architectures
  • Paradigms
  • Technologies

There are also some common consequences, and here they are:-

  • Integrity: Incase if the memory area in question has been administered and used properly elsewhere then the freed memory might corrupt the valid data.
  • Availability: The whole process might get crash, incase if any chunk consolidation occurs and it will show that invalid data is utilized as chunk information.
  • In integrity, Confidentiality, Availability: In case any ill-disposed data is inserted before chunk consolidation then it might take benefit of a write-what-where fundamental to perform the arbitrary code.

Google Patched third Chrome zero-day flaw

Google has also patched the third Chrome Zero-day flaw this year, and the bug was named CVE-2021-21166. It was exploited in the wild and was being portrayed as an “Object lifecycle issue in audio” the experts have addressed the flaw along with the release of Chrome 89.0.4389.72.

While on February 4, the company finally resolved another actively-exploited heap buffer overflow flaw in its V8 JavaScript rendering engine.

Not only this but in the case of this vulnerability, Chrome users can simply update to the latest version by going to Settings > Help > About Google Chrome to decrease the risk that is blended with the flaw.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity, and hacking news updates.


Latest articles

Octo Tempest Know for Attacking VMWare ESXi Servers Added RansomHub & Qilin to Its Arsenal

Threat actors often attack VMware ESXi servers since they accommodate many virtual machines, which...

TAG-100 Actors Using Open-Source Tools To Attack Gov & Private Orgs

Hackers exploit open-source tools to execute attacks because they are readily available, well-documented, and...

macOS Users Beware Of Weaponized Meeting App From North Korean Hackers

Meeting apps are often targeted and turned into weapons by hackers as they are...

Hackers Exploiting Legitimate RMM Tools With BugSleep Malware

Since October 2023, MuddyWater, which is an Iranian threat group linked to MOIS, has...

Cybercriminals Exploit Attack on Donald Trump for Crypto Scams

Researchers at Bitdefender Labs remain ever-vigilant, informing users about the latest scams and internet...

New TE.0 HTTP Request Smuggling Flaw Impacts Google Cloud Websites

HTTP Request Smuggling is a flaw in web security that is derived from variations...

Volcano Demon Group Attacking Organizations With LukaLocker Ransomware

The Volcano Demon group has been discovered spreading a new ransomware called LukaLocker, which...
Guru baran
Guru baran
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles