Google Chrome update fixes 0-day vulnerability exploited in the wild

[harlan4096]

Google has released a security update for Google Chrome Stable and Google Chrome Extended Stable that addresses a security vulnerability that is exploited in the wild.

Chrome users are encouraged to update Google Chrome to the latest version immediately to protect it from potential attacks.

The fastest way to do that is to load chrome://settings/help in the Chrome address bar. Google Chrome lists the current version and runs a check for updates. It should pick up the security update and start to download it. A restart is required to complete the process.

Chrome's Help page should now display one of the following versions (depending on operating system and channel):

• Chrome for Linux or Mac: 120.0.6099.129
  
• Chrome for Windows: 120.0.6099.129 or 120.0.6099.130
  
• Chrome Extended for Mac: 120.0.6099.129
  
• Chrome Extended for Windows: 120.0.6099.130
  

Automatic updates may take longer. Google notes that these may take days or sometimes even weeks before they land on all devices with Chrome Stable or Extended installed.

About the vulnerability



Google announced the update on the official releases blog. There, the company reveals that the security issue is a heap buffer overflow bug in WebRTC. It assigned a high security rating to the vulnerability and confirmed that it is aware of attacks in the wild: "Google is aware that an exploit for CVE-2023-7024 exists in the wild".

The issue was discovered by members of Google's Threat Analysis Group TAG.

Additional information about security issues, especially those with exploits in the wild, is not provided by Google until the majority of Chrome installations have upgraded to  a newer version that contains a fix.

The 0-day vulnerability is the eighths of the year in Chrome and Chromium-based browsers.

All Chromium-based web browsers are affected by the issue as well. Expect updates for browsers such as Microsoft Edge, Brave, Vivaldi or Opera in the coming days as well because of that.

Google launched Chrome 120 on December 6 to the public. The browser fixed several security issues as well and introduced new features, such as password sharing between family account members.
...

Continue Reading