While many expected — or at least hoped — that the 4th of July would be quiet on the cybersecurity front, Google on Monday announced the release of an emergency Chrome update that patches an actively exploited zero-day vulnerability.
The flaw, tracked as CVE-2022-2294, has been described as a heap buffer overflow in WebRTC. The security hole was reported to Google by a member of the Avast Threat Intelligence team on July 1.
The zero-day has been patched with the release of Chrome 103.0.5060.114 for Windows.
No information has been made available about the attacks exploiting CVE-2022-2294. SecurityWeek has reached out to Avast for more information and will update this article if the company can share any details.
This is the fourth actively exploited Chrome vulnerability that Google has patched this year. The company said recently that it has observed a total of 18 exploited zero-day vulnerabilities in the first half of 2022, and many of them exist because previous flaws were not properly addressed.
In addition to CVE-2022-2294, the latest Chrome update patches two other high-severity issues: CVE-2022-2295, a type confusion in the V8 engine, and CVE-2022-2296, a use-after-free in the Chrome OS Shell component.
Related: Chrome 102 Update Patches High-Severity Vulnerabilities
Related: Google Issues Emergency Fix for Chrome Zero-Day
Related: Emergency Firefox Update Patches Two Actively Exploited Zero-Day Vulnerabilities
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Unpatched Security Flaws Expose Water Pump Controllers to Remote Hacker Attacks
- 3CX Confirms Supply Chain Attack as Researchers Uncover Mac Component
- OpenSSL 1.1.1 Nears End of Life: Security Updates Only Until September 2023
- Google Links More iOS, Android Zero-Day Exploits to Spyware Vendors
- ChatGPT Data Breach Confirmed as Security Firm Warns of Vulnerable Component Exploitation
- Thousands Access Fake DDoS-for-Hire Websites Set Up by UK Police
- Intel Boasts Attack Surface Reduction With New 13th Gen Core vPro Platform
- Dole Says Employee Information Compromised in Ransomware Attack
Latest News
- Anti-Bot Software Firm DataDome Banks $42M Financing
- Unpatched Security Flaws Expose Water Pump Controllers to Remote Hacker Attacks
- 500k Impacted by Data Breach at Debt Buyer NCB
- Chinese Cyberspies Use ‘Melofee’ Linux Malware for Stealthy Attacks
- Why Endpoint Resilience Matters
- Microsoft Cloud Vulnerability Led to Bing Search Hijacking, Exposure of Office 365 Data
- 3CX Confirms Supply Chain Attack as Researchers Uncover Mac Component
- UK Introduces Mass Surveillance With Online Safety Bill
