Thursday, April 18, 2024

New Google Chrome Zero-Day Bug Actively Exploited in Wide – Emergency Update!

On April 18, 2023, Google released a new update for Chrome Desktop versions with security updates for actively exploited second Chrome zero-day vulnerability that allows attackers to execute an arbitrary code to take complete control of the system remotely.

CVE-2023-2136 is an integer overflow bug that threat actors have now exploited in the wild.

Google recently released an update for the first Chrome zero-day this year. A week later, the second zero-day was discovered, fixed, and released the patch for the same.

Stable Update Channel Release

Google has released a fixed version of Chrome on the below platforms.

  • Windows version: 112.0.5615.137/138
  • Mac version:  112.0.5615.137 
  • Linux version:  112.0.5615.165

Clément Lecigne, who works in Google’s Threat Analysis Group (TAG), reported the first zero-day of Google on 11th April 2023.

He reported the second zero-day on 12th April 2023, one day before the first zero-day.

The patched version comes with an overwhelming 8 bug fixes, as mentioned by Google.

  • High CVE-2023-2133: Out-of-bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30.
  • High CVE-2023-2134: Out-of-bounds memory access in Service Worker API. Reported by Rong Jian of VRI on 2023-03-30.
  • High CVE-2023-2135: Use after free in DevTools. Reported by Cassidy Kim(@cassidy6564) on 2023-03-14.
  • High CVE-2023-2136: Integer overflow in Skia. Reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-04-12 (Exploited in the wild).
  • Medium CVE-2023-2137: Heap buffer overflow in SQLite. Reported by Nan Wang(@eternalsakura13) and Guang Gong of 360 Vulnerability Research Institute on 2023-04-05.

Rewards have been given for the above security researchers, ranging between $3000 and $8000. Google has not published any other details on this vulnerability.

“Google is aware that an exploit for CVE-2023-2136 exists in the wild. Access to bug details and links may be restricted until most users are updated with a fix.

We will also retain restrictions if the bug exists in a third-party library that other projects similarly depend on, but haven’t yet fixed.” Google Says.

This new zero-day is exploited in the Skia, a 2-D Graphics library that most web developers use for creating great high-quality web experiences and graphics.

Update Now

To address the actively exploited security issue, the following are the steps that you need to follow to start the manual process of updating Chrome to the latest version:-

Google Chrome 112.0
  • First of all, open the Chrome settings menu in the upper right corner.
  • Then you have to select the “Help” option.
  • Now select the “About Google Chrome” option.
  • Now, your Chrome will check for the latest available update and download it.

So, to prevent further exploitation, it’s strongly recommended that users apply the available update as soon as they become available.

Google has requested its users to update the Chrome version as soon as possible.

Looking for an All-in-One Multi-OS Patch Management Platform – Try Patch Manager Plus


Latest articles

Xiid SealedTunnel: Unfazed by Yet Another Critical Firewall Vulnerability (CVE-2024-3400)

In the wake of the recent disclosure of a critical vulnerability (CVE-2024-3400) affecting a...

Cerber Linux Ransomware Exploits Atlassian Servers to Take Full Control

Security researchers at Cado Security Labs have uncovered a new variant of the Cerber...

FGVulDet – New Vulnerability Detector to Analyze Source Code

Detecting source code vulnerabilities aims to protect software systems from attacks by identifying inherent...

North Korean Hackers Abuse DMARC To Legitimize Their Emails

DMARC is targeted by hackers as this serves to act as a preventative measure...

L00KUPRU Ransomware Attackers discovered in the wild

A new variant of the Xorist ransomware, dubbed L00KUPRU, has been discovered in the...

Oracle Releases Biggest Security Update in 2024 – 372 Vulnerabilities Are Fixed – Update Now!

Oracle has released its April 2024 Critical Patch Update (CPU), addressing 372 security vulnerabilities...

Outlook Login Panel Themed Phishing Attack Evaded All Antivirus Detections

Cybersecurity researchers have uncovered a new phishing attack that has bypassed all antivirus detections.The...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.


Mastering WAAP/WAF ROI Analysis

As the importance of compliance and safeguarding critical websites and APIs grows, Web Application and API Protection (WAAP) solutions play an integral role.
Key takeaways include:

  • Pricing models
  • Cost Estimation
  • ROI Calculation

Related Articles