Connect with us

Hi, what are you looking for?



High-Severity Memory Safety Bugs Patched With Latest Chrome 108 Update

Google this week announced a Chrome update that resolves eight vulnerabilities in the popular browser, including five reported by external researchers.

Google this week announced a Chrome update that resolves eight vulnerabilities in the popular browser, including five reported by external researchers.

All five security defects are use-after-free flaws, a type of memory safety bug that has been prevalent in Chrome over the past years, and which Google has long-battled to eliminate.

According to Google’s advisory, four of these issues are high-severity bugs, impacting components such as Blink Media, Mojo IPC, Blink Frames, and Aura.

The vulnerabilities have been issued CVE identifiers CVE-2022-4436 to CVE-2022-4439 and are accompanied by CVE-2022-4440, a medium-severity use-after-free.

Google says it has paid $17,500 in bug bounties to the reporting researchers, but the final amount might be higher, as only four out of five rewards have been disclosed.

The latest Chrome browser release is currently rolling out to Mac and Linux users as version 108.0.5359.124, and to Windows users as version 108.0.5359.124/.125.

Google makes no mention of any of these vulnerabilities being exploited in malicious attacks. To date, there have been nine documented Chrome zero-day flaws in 2022.

Advertisement. Scroll to continue reading.

Related to the incorrect use of dynamic memory while a program is running, use-after-free issues exist because, after freeing a memory location, an application might not clear the pointer to that location.

An attacker in a position to exploit a use-after-free vulnerability may be able to crash the application, corrupt data, or execute arbitrary code on the machine. In Chrome, use-after-free flaws may be used to escape the browser sandbox, which requires the exploitation of additional security defects.

Over the past couple of years, Google announced several efforts to eliminate memory safety bugs in both Android and Chrome, and recently announced improved protections against the exploitation of such vulnerabilities.

Related: Chrome 108 Patches High-Severity Memory Safety Bugs

Related: Google Patches Eighth Chrome Zero-Day of 2022

Related: NSA Publishes Guidance on Mitigating Software Memory Safety Issues

Written By

Ionut Arghire is an international correspondent for SecurityWeek.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

SecurityWeek’s Threat Detection and Incident Response Summit brings together security practitioners from around the world to share war stories on breaches, APT attacks and threat intelligence.


Securityweek’s CISO Forum will address issues and challenges that are top of mind for today’s security leaders and what the future looks like as chief defenders of the enterprise.


Expert Insights

Related Content


Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Data Breaches

OpenAI has confirmed a ChatGPT data breach on the same day a security firm reported seeing the use of a component affected by an...

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...


The latest Chrome update brings patches for eight vulnerabilities, including seven reported by external researchers.


Patch Tuesday: Microsoft warns vulnerability (CVE-2023-23397) could lead to exploitation before an email is viewed in the Preview Pane.


Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

IoT Security

A group of seven security researchers have discovered numerous vulnerabilities in vehicles from 16 car makers, including bugs that allowed them to control car...

IoT Security

A vulnerability affecting Dahua cameras and video recorders can be exploited by threat actors to modify a device’s system time.