Google released Chrome 115 to the stable channel for Windows, MacOS, and Linux on Tuesday, patching 20 vulnerabilities, including 11 that were discovered by external researchers.
Four security issues were assessed to be of “high severity,” while six were determined to be of “medium severity.”
This browser update also fixes a ‘low-severity’ issue with Themes’ insufficient validation of untrusted input.
The two use-after-free issues affecting the WebRTC component tracked as CVE-2023-3727 and CVE-2023-3728, are the most significant flaws identified.
These vulnerabilities, recognized by Google and rewarded with a $7,000 bounty each, are as major as they are critical.
CVE-2023-3730, a use-after-free weakness in Tab Groups, is another high-severity defect that Chrome 115 fixes. The researcher who discovered it received a $2,000 bug prize.
Additionally, Mark Brand of Google Project Zero identified CVE-2023-3732, an out-of-bounds memory access in Mojo. No bug bounty was offered for this internal discovery by Google’s rules.
System failures or data corruption may result from a use-after-free vulnerability that enables an attacker to run arbitrary code.
On the other side, a vulnerability that allows for out-of-bounds memory access might allow a hacker to access data that they are not meant to, potentially resulting in data breaches.
Additionally, Chrome 115 fixes six medium-severity vulnerabilities that were reported externally.
Inappropriate implementations of several components, including Picture in Picture, Custom Tabs, Notifications, Autofill, WebApp Installs, and Web API Permission Prompts, caused the flaws.
If exploited, these flaws might have adverse effects, including enabling attackers to get around access restrictions and take illegal acts.
Although Google has not revealed any ongoing exploits of these vulnerabilities, it is strongly encouraged to apply its update immediately to protect against prospective attacks.
For ‘low-severity’ insufficient validation of untrusted input bugs in Themes, the reporting researchers have received a total of $34,000 in bug bounty awards.
By choosing Menu > Help > About Google Chrome or by typing chrome://settings/help straight into the browser’s address bar, users may determine the version that is currently installed.
When a website is opened on a desktop machine, Google Chrome shows the installed version and checks for updates.
To shield the browser and system against potential vulnerabilities, it is advised to apply the update as soon as possible.
Stay up-to-date with the latest Cyber Security News; follow us on GoogleNews, Linkedin, Twitter, and Facebook.
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…