Google on Monday released a Chrome 114 security update that patches the third zero-day vulnerability found in the web browser in 2023.
Google said the latest version of Chrome patches two flaws, including CVE-2023-3079, a type confusion issue affecting the V8 JavaScript engine.
The internet giant noted that the vulnerability, discovered on June 1, has been exploited in the wild, but has not shared any information on the attacks.
However, the fact that the security hole and its exploitation were discovered by Clement Lecigne of Google’s Threat Analysis Group suggests that CVE-2023-3079 has likely been exploited by a commercial spyware vendor.
Google regularly publishes blog posts describing the exploits used by various spyware vendors, which typically advertise their products for lawful surveillance by government agencies. However, their solutions have often been abused by totalitarian regimes to spy on critics.
In many cases, spyware vendors integrate Chrome vulnerabilities into complex exploit chains that are designed to target Android devices.
Google announced recently that it’s temporarily offering up to $180,000 through its bug bounty program for a full chain exploit that leads to a sandbox escape in Chrome.
In 2022, the company patched nine Chrome zero-days, including five discovered by its Threat Analysis Group.
Related: Google Warns of New Chrome Zero-Day Attack
Related: Android Security Update Patches Kernel Vulnerability Exploited by Spyware Vendor
Related: Details Emerge on Israeli Spyware Vendor QuaDream and Its iOS Malware
Eduard Kovacs (@EduardKovacs) is a managing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
- Cisco to Acquire Splunk for $28 Billion
- Car Cybersecurity Study Shows Drop in Critical Vulnerabilities Over Past Decade
- Omron Patches PLC, Engineering Software Flaws Discovered During ICS Malware Analysis
- Intel Launches New Attestation Service as Part of Trust Authority Portfolio
- Atos Unify Vulnerabilities Could Allow Hackers to Backdoor Systems
Latest News
- Researchers Discover Attempt to Infect Leading Egyptian Opposition Politician With Predator Spyware
- In Other News: New Analysis of Snowden Files, Yubico Goes Public, Election Hacking
- China’s Offensive Cyber Operations in Africa Support Soft Power Efforts
- Air Canada Says Employee Information Accessed in Cyberattack
- BIND Updates Patch Two High-Severity DoS Vulnerabilities
- Faster Patching Pace Validates CISA’s KEV Catalog Initiative
- SANS Survey Shows Drop in 2023 ICS/OT Security Budgets
- Apple Patches 3 Zero-Days Likely Exploited by Spyware Vendor to Hack iPhones
