Google this week announced a Chrome update that resolves a total of 11 vulnerabilities in the browser, including six reported by external researchers.
Of these, five are use-after-free issues, including four that are considered “high severity.” Use-after-free flaws are triggered when a program does not clear the pointer after freeing memory allocation.
Such vulnerabilities may lead to the execution of arbitrary code, to denial of service, or the corruption of data but, if they are combined with other issues, can allow for a full system compromise.
In Chrome, use-after-free bugs can often be exploited to escape the browser’s sandbox.
The four high-severity use-after-free vulnerabilities resolved with the latest Chrome 103 update are tracked as CVE-2022-2477, CVE-2022-2478, CVE-2022-2480, and CVE-2022-2481, and impact components such as Guest View, PDF, Service Worker API, and Views.
Google says it has paid $16,000 and $7,500 in bug bounty rewards for the first two flaws, but hasn’t determined the amount to be handed out for the last issue. As per the company’s policy, no reward will be issued for CVE-2022-2480, which was reported by a Google Project Zero researcher.
However, the internet giant did pay $3,000 for CVE-2022-2479, a high-severity issue related to insufficient validation of untrusted input in the File component.
The sixth externally reported vulnerability addressed with this Chrome update is CVE-2022-2163, a low-severity use-after-free issue in Cast UI and Toolbar, which earned the reporting researcher a $7,000 bug bounty reward.
Google makes no mention of any of these vulnerabilities being exploited in the wild.
The latest Chrome update is currently rolling out to Windows, Mac, and Linux users as version 103.0.5060.134.
Related: Google Patches 14 Vulnerabilities With Release of Chrome 103
Related: Emergency Chrome 103 Update Patches Actively Exploited Vulnerability
Related: Google Announces New Chrome and Chrome OS Security Features for Enterprises
More from Ionut Arghire
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- CISA, NSA Issue Guidance for IAM Administrators
- Cisco Patches High-Severity Vulnerabilities in IOS Software
- ‘Nexus’ Android Trojan Targets 450 Financial Applications
- ‘Badsecrets’ Open Source Tool Detects Secrets in Many Web Frameworks
- Chrome 111 Update Patches High-Severity Vulnerabilities
Latest News
- US Charges 20-Year-Old Head of Hacker Site BreachForums
- Tesla Hacked Twice at Pwn2Own Exploit Contest
- CISA Ships ‘Untitled Goose Tool’ to Hunt for Microsoft Azure Cloud Infections
- Critical WooCommerce Payments Vulnerability Leads to Site Takeover
- PoC Exploit Published for Just-Patched Veeam Data Backup Solution Flaw
- CISA Gets Proactive With New Pre-Ransomware Alerts
- Watch on Demand: Supply Chain & Third-Party Risk Summit Sessions
- TikTok CEO Grilled by Skeptical Lawmakers on Safety, Content
