Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

Vulnerabilities

Chrome 103 Update Patches High-Severity Vulnerabilities

Google this week announced a Chrome update that resolves a total of 11 vulnerabilities in the browser, including six reported by external researchers.

Of these, five are use-after-free issues, including four that are considered “high severity.” Use-after-free flaws are triggered when a program does not clear the pointer after freeing memory allocation.

Google this week announced a Chrome update that resolves a total of 11 vulnerabilities in the browser, including six reported by external researchers.

Of these, five are use-after-free issues, including four that are considered “high severity.” Use-after-free flaws are triggered when a program does not clear the pointer after freeing memory allocation.

Such vulnerabilities may lead to the execution of arbitrary code, to denial of service, or the corruption of data but, if they are combined with other issues, can allow for a full system compromise.

In Chrome, use-after-free bugs can often be exploited to escape the browser’s sandbox.

The four high-severity use-after-free vulnerabilities resolved with the latest Chrome 103 update are tracked as CVE-2022-2477, CVE-2022-2478, CVE-2022-2480, and CVE-2022-2481, and impact components such as Guest View, PDF, Service Worker API, and Views.

Google says it has paid $16,000 and $7,500 in bug bounty rewards for the first two flaws, but hasn’t determined the amount to be handed out for the last issue. As per the company’s policy, no reward will be issued for CVE-2022-2480, which was reported by a Google Project Zero researcher.

However, the internet giant did pay $3,000 for CVE-2022-2479, a high-severity issue related to insufficient validation of untrusted input in the File component.

The sixth externally reported vulnerability addressed with this Chrome update is CVE-2022-2163, a low-severity use-after-free issue in Cast UI and Toolbar, which earned the reporting researcher a $7,000 bug bounty reward.

Google makes no mention of any of these vulnerabilities being exploited in the wild.

The latest Chrome update is currently rolling out to Windows, Mac, and Linux users as version 103.0.5060.134.

Related: Google Patches 14 Vulnerabilities With Release of Chrome 103

Related: Emergency Chrome 103 Update Patches Actively Exploited Vulnerability

Related: Google Announces New Chrome and Chrome OS Security Features for Enterprises

Related: Chrome Browser Gets Major Security Update

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

Vulnerabilities

GoAnywhere MFT users warned about a zero-day remote code injection exploit that can be targeted directly from the internet