"The bug likely manifests when a user attempts to use an Intent for some purpose. "Web Intents are based on Android Intents and offer integration to web applications for developers," Trend Micro Zero Day Initiative senior communications manager Dustin Childs told TechTarget Editorial. While Google was less than forthcoming with details on the under-attack vulnerability, researchers were able to figure out enough to know that the bug could potentially be dangerous when exploited. Google's advisory did not provide much information on the vulnerability itself, only describing the issue as "insufficient validation of untrusted input in Intents." Intents is an API that allows the Chrome browser to open outside applications.Īshley Shen and Christian Resell of Google Threat Analysis Group were credited with reporting the bug to Chrome's developer team. Google noted that the vulnerability is currently under exploitation in the wild. The update takes the browser to version 1.41.Included in the update was a patch for CVE-2022-2856, a zero-day vulnerability in the way the Intents component handles input validation. None of these have been exploited yet, the company says, but seven are rated as being a high risk. On April 27, Google announced another Chrome update, fixing 30 security vulnerabilities. The Chrome issue also impacts other Chromium-based browsers, including Brave, Microsoft Edge, Opera, and Vivaldi, so if you use one of those, make sure you apply the patch.īut that’s not all.
You’ll need to restart Chrome after the update has installed to ensure it activates. If you use Chrome, your browser should now be on version 1.127 to include the fix. The technical details aren’t currently available, but the timing of the fix-just a day after it was reported-indicates it’s pretty serious. The latest, pushed out in mid-April, fixes two issues including a high-severity zero-day vulnerability, CVE-2022-1364, which is already being used by attackers. It has been a particularly busy month for the team behind Google’s Chrome browser, which has seen several security updates within weeks of each other.
0 kommentar(er)
