Google has patched seven vulnerabilities in its Chrome browser , including two zero-days , that were discovered and exploited by researchers during the hacking Pwn2Own Vancouver . 2024 competition
The first vulnerability is tracked as CVE-2024-2887 and is a serious “type confusion weakness” in the WebAssembly (Wasm) open standard. The vulnerability was discovered by Manfred Paul on the first day of Pwn2Own and was used for remote code execution (specifically double-tap RCE), using a crafted HTML page. It targeted both Chrome and Edge.
See also: AnyCubic fixes zero-day in 3D printers
The second Chrome zero-day vulnerability is tracked as CVE-2024-2886 and was exploited by Seunghyun Lee of KAIST Hacking Lab during the second day of the CanSecWest Pwn2Own competition. It is described as a use-after-free (UAF) vulnerability in the WebCodecs API, which is used by web applications to encode and decode audio and video. The vulnerability allows remote attackers to perform arbitrary reads/writes via crafted HTML pages.
Lee also used the zero-day CVE-2024-2886 to perform remote code execution in Google Chrome and Microsoft Edge.
Google has fixed two zero-day vulnerabilities in the Google Chrome stable channel, version 123.0.6312.86/.87 for Windows and Mac and 123.0.6312.86 for Linux users.
See also: Apple fixes two iOS zero-day vulnerabilities
Vendors have 90 days to issue patches for vulnerabilities presented in Pwn2Own. After that time, Trend Micro's Zero Day Initiative publicly discloses details of the flaws, which could put users at serious risk, as cybercriminals will rush to exploit them.
The Pwn2Own 2024 Vancouver competition concluded on March 22, with security researchers winning $1,132,500 for demonstrating 29 zero-day exploits and exploit chains. Manfred Paul was named this year's winner with $202,500 in prize money.
Google updates that fix Chrome vulnerabilities are vital for users. They improve the security personal and professional data of users ' , protecting them from malware attacks or hacking.
The two Chrome zero-day vulnerabilities discovered during the Pwn2Own contest are particularly concerning. Fixing them will prevent malicious users from exploiting them.
See also: Microsoft: Critical vulnerability in Exchange Server was used as a zero-day
Additionally, Chrome's security update increases user confidence in the browser. Users can be confident that Google takes security and is doing everything it can to ensure it.
Finally, these fixes ensure that Chrome remains compatible with the latest technological developments and security. This is particularly important for maintaining the efficiency and reliability of the browser.
Source: www.bleepingcomputer.com
