Google Chrome 7th Zero Day
Share this:
Google has released Chrome 91.0.4472.114 for Windows, Mac, and Linux to fix four security vulnerabilities, with one of them a high severity zero-day vulnerability exploited in the wild.
No details on zero-day attacks in the wild
Google is aware that an exploit for CVE-2021-30554 exists in the wild.
The zero-day is caused by a use after free weakness in the WebGL JavaScript API used by the Chrome web browsers to render interactive 2D and 3D graphics without using plug-ins.
Successful exploitation of this vulnerability could lead to arbitrary code execution on computers running unpatched Chrome versions. Google says that it is aware of CVE-2021-30554 in the wild exploitation, it did not share info regarding these attacks.
Google fixed three more high severity use after free bugs today in Chrome’s Sharing, Web Audio, and TabGroups components, tracked as CVE-2021-30555, CVE-2021-30556, and CVE-2021-30557.
A threat actor group known as Puzzlemaker is chaining Chrome zero-day bugs to escape the browser’s sandbox and install malware on Windows systems.
Once the attackers have used both the Chrome and Windows exploits to gain a foothold in the targeted system, the stager module downloads and executes a more complex malware dropper from a remote server.
Chrome is becoming a hot spot honey trap to exploit.. Patch it be safe.
