Good news is, after 2022, we’re all good at deploying Chrome updates. Currently there is no evidence of active exploitation. The update addresses two critical use-after-free flaws, the most severe CVE-2023-0471 has a CVSS score of 8.8.So for those of you who never close your browser, this is your reminder to do so regularly.
Practitioner’s note: Remember that Chrome patches are applied automatically when it starts.These include use after free vulnerabilities in WebTransport, WebRTC, and GuestView, and a type confusion vulnerability in ServiceWorker API. Four of the flaws were submitted by external researchers. The newest version of the browser includes fixes for six vulnerabilities. However, if you keep multiple tabs open and rarely restart the browser, then you need to ensure it has been closed and reopened as a matter of urgency.Google has updated the Stable channel for Chrome to version to 1.119 for Mac and Linux and 1.119/.120 for Windows. This isn't a problem for the majority of users who, I suspect, close the browser and shut down their computer on a daily basis. The most important aspect of this is that the update is only applied, so offering you protection from the latest security vulnerabilities when the browser is closed and reopened. Google Chrome makes patching security issues in the browser simple, especially for Windows and Mac users, where the update is handled automatically. All 17 vulnerability updates are dealt with by a single Chrome patch
This just leaves four low-severity vulnerabilities patched as part of this first security update of 2023 to Google Chrome: CVE-2023-0138 (heap buffer overflow in libphonenumber), CVE-2023-0139 (insufficient validation of untrusted input in downloads), CVE-2023-0140 (inappropriate implementation in the file system API) and CVE-2023-0141 (insufficient policy enforcement in CORS).
Four low-severity Chrome security vulnerabilities
0 kommentar(er)
