Google has addressed a bug in Google Chrome's WebGL (Web Graphics Library) component that could lead to arbitrary code execution within the browser process after a successful exploit.
WebGL is a JavaScript API used by compatible browsers to render interactive 2D and 3D graphics without the use of plug-ins.
A fix for this code execution vulnerability is already included in the Google Chrome beta channel and will also be released to the Stable channel with the release of Google Chrome 85.0.4149.0 which will be released tomorrow according to the Chrome release schedule
High severity code execution vulnerability
The code execution security issue discovered by Cisco Talos senior research engineer Marcin Towalski was named CVE-2020-6492 and received a high 8.3 CVSSv3 Score.
The vulnerability causes an error when the WebGL component fails to properly handle objects in memory.
“This vulnerability is located in ANGLE, a compatibility layer between OpenGL and Direct3D used on Windows by the Chrome browser,” Cisco Talos explains in its advisory.
“By properly manipulating the memory layout, an attacker can gain full control of this vulnerability after use which could ultimately lead to arbitrary code execution within the browser.”
CVE-2020-6492 affects Google Chrome 81.0.4044.138 (Stable), 84.0.4136.5 (Dev), and 84.0.4143.7 (Canary) and was reported to Google on May 19.
Google Chrome security updates
The previous stable versions of Google Chrome (Chrome 84 and Chrome 83) addressed 38 vulnerabilities each, including security rated as critical and high severity.
Chrome 84 also came with increased protection against mixed content downloads and browser notification scams.
The previous version, Chrome 83, provided users with massive security and privacy, including a redesigned “Privacy & Security” settings section, a new security check feature, a new enhanced safe browsing feature, better cookie, improved DoH settings, and more.
Google did not release version 82 of Chrome and decided to skip this version due to the pandemic and move all its changes to the next version.
