{"id":18954,"date":"2022-11-25T18:44:57","date_gmt":"2022-11-25T18:44:57","guid":{"rendered":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/25\/google-releases-patch-for-zero-day-chrome-vulnerability\/"},"modified":"2022-11-25T18:44:57","modified_gmt":"2022-11-25T18:44:57","slug":"google-releases-patch-for-zero-day-chrome-vulnerability","status":"publish","type":"post","link":"https:\/\/mailinvest.blog\/index.php\/2022\/11\/25\/google-releases-patch-for-zero-day-chrome-vulnerability\/","title":{"rendered":"Google releases patch for zero-day Chrome vulnerability"},"content":{"rendered":"

<\/a>\n
<\/p>\n

\n

Google LLC has begun rolling out a patch for a high-severity security vulnerability that affects the desktop version of its Chrome browser.<\/span><\/p>\n

The company disclosed the move in a Thursday <\/span>blog post<\/span><\/a>. The vulnerability, which is tracked as CVE-2022-4135, affects the Windows, Mac and Linux editions of Chrome. Google stated that the patch will roll out over the coming days and weeks.<\/span><\/p>\n

\u201cGoogle is aware that an exploit for CVE-2022-4135 exists in the wild,\u201d the company stated in the blog post. The existence of the exploit suggests that hackers may be targeting vulnerable installations of Chrome.<\/span><\/p>\n

Researchers measure the severity of software vulnerabilities using an industry-standard framework known as CVSS. According to Google, the severity of CVE-2022-4135 is ranked as High under the CVSS framework. That\u2019s the second-highest severity ranking a vulnerability can receive after Critical.\u00a0<\/span><\/p>\n

CVE-2022-4135 affects a component of Chrome that is known as the renderer process. When a user visits a web page, Chrome downloads the page in the form of a collection of code files. Chrome\u2019s renderer process is responsible for turning the code files into a functioning webpage that the user can interact with.<\/span><\/p>\n

For cybersecurity reasons, Google\u2019s browser runs each web page in a so-called <\/span>sandbox<\/span><\/a>. The sandbox blocks the code in a page from accessing key components of the user\u2019s operating system. According to Google, this makes it more difficult for malicious code to gain a foothold on the user\u2019s computer.<\/span><\/p>\n

CVE-2022-4135, the newly patched vulnerability in Chrome, can potentially allow hackers to bypass Chrome\u2019s sandbox mechanism. Bypassing the mechanism makes it easier for malware to temper with the user\u2019s operating system. According to an <\/span>explainer<\/span><\/a> released by the National Institute of Standards and Technology, hackers can target CVE-2022-4135 using malicious web pages.<\/span><\/p>\n

The vulnerability opens the door to cyberattacks because it enables hackers to create a phenomenon known as a heap buffer overflow.<\/span><\/p>\n

Programs such as Chrome store both their code and the data they process on the memory of the user\u2019s computer. The memory used by a program while it\u2019s running is divided into sections known as buffers. One buffer might contain a part of Chrome\u2019s source code, while another may contain a portion of the web page the user has opened.\u00a0<\/span><\/p>\n

A buffer overflow occurs when more data is written to a buffer than it can accommodate. The excess data is written to other buffers, overwriting the information they contain. Hackers can use this phenomenon to overwrite parts of a program with malicious code.<\/span><\/p>\n

Google\u2019s patch for the buffer overflow flaw in Chrome is rolling out about three months after the company <\/span>fixed<\/span><\/a> another high-severity vulnerability that affected the browser. According to Google, the latter vulnerability was discovered in one of Chrome\u2019s runtime libraries. A runtime library is a piece of software on which another program depends to work.\u00a0<\/span><\/p>\n

Image: Google<\/h5>\n
\n
\n

Show your support for our mission by joining our Cube Club and Cube Event Community of experts. Join the community that includes Amazon Web Services and Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger and many more luminaries and experts.<\/span><\/h3>\n<\/div><\/div>\n