Google Releases Security Update Addressing Multiple Vulnerabilities in Google Chrome

Security update addresses one Medium and four High severity vulnerabilities in Google Chrome, including an actively exploited zero-day vulnerability

Threat ID:: CC-4305
Threat Severity:: Medium
Published:: 20 April 2023 3:06 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security update addresses one Medium and four High severity vulnerabilities in Google Chrome, including an actively exploited zero-day vulnerability

Affected platforms

The following platforms are known to be affected:

Google Chrome for Windows, macOS and Linux

All prior to 112.0.5615.137/138 for Windows
All prior to 112.0.5615.137 for Mac
All prior to 112.0.5615.165 for Linux

Threat details

Introduction

Google has released a security update which addresses one Medium and four High severity vulnerabilities in Google Chrome for Windows, Mac, and Linux. The High severity vulnerabilities include a zero-day tracked as CVE-2023-2136 related to an integer overflow. A remote attacker could exploit one of these vulnerabilities to take control of an affected system.

Exploitation of CVE-2023-2136

Google is aware that an exploit for CVE-2023-2136 exists in the wild.

Remediation advice

Affected organisations are encouraged to review the Chrome Release and apply the necessary updates to the latest release.

Definitive source of threat updates

https://chromereleases.googleblog.com/2023/04/stable-channel-update-for-desktop_18.html

CVE Vulnerabilities

Status Published

CVE-2023-2133

Out of bounds memory access in Service Worker API in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Status Published

CVE-2023-2134

Status Published

CVE-2023-2135

Use after free in DevTools in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who convinced a user to enable specific preconditions to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Status Published

CVE-2023-2136

Integer overflow in Skia in Google Chrome prior to 112.0.5615.137 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

Status Published

CVE-2023-2137

Heap buffer overflow in sqlite in Google Chrome prior to 112.0.5615.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Last edited: 20 April 2023 3:06 pm