Google Releases Security Update for Chrome

Security update released to address an actively exploited zero-day vulnerability in Chrome

Threat ID:: CC-4220
Threat Severity:: Information only
Published:: 25 November 2022 11:15 AM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update released to address an actively exploited zero-day vulnerability in Chrome

Affected platforms

The following platforms are known to be affected:

Versions: Prior to 107.0.5304.121 for Mac and Linux, Prior to 107.0.5304.121/.122 for Windows

Google Chrome for Windows, macOS and Linux

Threat details

Introduction

Google has released a security update to address a High severity zero-day vulnerability tracked as CVE-2022-4135. An attacker could exploit this vulnerability to take control of an affected system.

Google confirms that an exploit for CVE-2022-4135 exists in the wild.

Exploitation in the wild for CVE-2022-4135

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2022-4135 to their Known Exploited Vulnerabilities Catalog.

Remediation advice

Affected organisations are encouraged to review the Chrome Release and apply the necessary updates to the latest release.

Definitive source of threat updates

https://chromereleases.googleblog.com/2022/11/stable-channel-update-for-desktop_24.html

CVE Vulnerabilities

Status Published

CVE-2022-4135

Heap buffer overflow in GPU in Google Chrome prior to 107.0.5304.121 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Last edited: 29 November 2022 2:57 pm