A security researcher has dropped a zero-day remote code execution vulnerability on Twitter that works on the current version of Google Chrome and Microsoft Edge.
On your computer, open Chrome. At the top right, click More Settings. At the bottom, click Advanced. Under 'Languages,' click Language. Next to the language you'd like to use, click More. If the language isn't listed, add it by clicking Add languages. Click Display Google Chrome in this language. This option is only available on Windows computers.
Disable Google Chrome extensions. Not all extensions are equal, and sometimes, extension. Google’s Chrome web browser is the world’s most popular way for people to navigate the web. But it’s far from perfect.
A zero-day vulnerability is a security bug that has been publicly disclosed but has not been patched in the released version of the affected software.
- The Chrome team is excited to announce the promotion of Chrome 91 to the Beta channel for Windows, Mac and Linux. Chrome 91.0.4472.19 contains our usual under-the-hood performance and stability tweaks, but there are also some cool new features to explore - please head to the Chromium blog to learn more!
- Google Chrome is a cross-platform web browser developed by Google. It was first released in 2008 for Microsoft Windows built with free software components from Apple WebKit and Mozilla Firefox. It was later ported to Linux, macOS, iOS, and Android where it is the default browser built into the OS.
Today, security researcher Rajvardhan Agarwal released a working proof-of-concept (PoC) exploit for a remote code execution vulnerability for the V8 JavaScript engine in Chromium-based browsers.
Just here to drop a chrome 0day. Yes you read that right.https://t.co/sKDKmRYWBPpic.twitter.com/PpVJrVitLR
— Rajvardhan Agarwal (@r4j0x00) April 12, 2021While Agarwal states that the vulnerability is fixed in the latest version of the V8 JavaScript engine, it is not clear when Google will roll out the Google Chrome.
When the PoC HTML file, and its corresponding JavaScript file, are loaded in a Chromium-based browser, it will exploit the vulnerability to launch the Windows calculator (calc.exe) program.
While no developer likes a zero-day release for their software, the good thing is that Agarwal's zero-day cannot currently escape the browser's sandbox. The Chrome sandbox is a browser security boundary that prevents remote code execution vulnerabilities from launching programs on the host computer.
For Agarwal's zero-day RCE exploit to work, it would need to be chained with another vulnerability that can allow the exploit to escape the Chromium sandbox.
To test the exploit, BleepingComputer launched the Microsoft Edge and Google Chrome browsers with the --no-sandbox flag, which turns off the Chromium sandbox.
With the sandbox disabled, we could use Agarwal's exploit to launch Calculator on our Windows 10 device. Our tests' exploitable versions are Google Chrome 89.0.4389.114 and Microsoft Edge 89.0.774.76, which are the latest versions in the Stable channel.
This vulnerability is believed to be the same one used by Dataflow Security's Bruno Keith and Niklas Baumstark at Pwn2Own 2021, where the researchers exploited Google Chrome and Microsoft Edge.
getting popped with our own bugs wasn't on my bingo card for 2021. not sure it was too smart of Google to add that regression test right away... https://t.co/e0RUlmbxRK
— Niklas B (@_niklasb) April 12, 2021
Google Chrome Is An Example Of
Google is expected to release Chrome 90 to the Stable channel tomorrow, and we will have to see if the upcoming version includes a fix for this zero-day RCE vulnerability.
BleepingComputer has contacted Google about the zero-day but has not received a reply as of yet.
Google Chrome Is Always On Top
Related Articles: