Chrome Turbofan Remote Code Execution

Older versions of Google Chrome can be affected by a type confusion vulnerability which is designed to confuse JavaScript code and allow an attacker to execute remote code in the browser.

Threat ID:: CC-1588
Category:: Spyware
Threat Severity:: Medium
Threat Vector:: Exploit
Published:: 18 August 2017 12:00 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

This content has been archived

This article no longer conforms to NHS Digital's standards for cyber alerts, and may contain outdated or inaccurate information. Use of this information contained in this page is at your own risk

Summary

Older versions of Google Chrome can be affected by a type confusion vulnerability which is designed to confuse JavaScript code and allow an attacker to execute remote code in the browser.

Affected platforms

The following platforms are known to be affected:

Google Chrome

Google Chrome - version 59 and earlier

Threat details

Turbofan is a component in Google Chrome used to optimise JavaScript code. In order for this vulnerability to be exploited, a user will need to visit a malicious website which will then send malicious JavaScript code, allowing remote code execution (RCE) to take place. By exploiting this vulnerability, it can allow an attacker to steal browser data such as passwords and cookies.

Google aren’t working on a patch for this vulnerability as it doesn’t affect Google Chromes latest version (version 60). In order to avoid falling victim to this RCE attack, users are encouraged to ensure they keep their Google Chrome browser up-to-date.

Remediation steps

Type	Step
	Ensure browsers and third-party plug-ins are kept regularly updated.

Last edited: 17 February 2020 11:28 am