Google Addresses 5th Actively Exploited Chrome Zero-Day of 2023

Google Addresses 5th Actively Exploited Chrome Zero-Day of 2023: Google has swiftly responded to the discovery of yet another Chrome zero-day vulnerability, marking the fifth such incident this year.

This emergency security update comes as part of Google’s ongoing efforts to fortify its browser against cyber threats.

Key Takeaways on Exploited Chrome Zero-Day of 2023:

• Fifth Zero-Day Vulnerability: Google has patched a zero-day vulnerability (CVE-2023-5217) in Chrome, marking the fifth such vulnerability to be actively exploited this year. This underscores the persistent challenges in maintaining browser security.
• Immediate Security Measures: Google has released a security update, Chrome version 117.0.5938.132, to address this vulnerability. The update is already available and will be automatically installed upon the browser’s next launch.
• Spyware Exploitation: The zero-day vulnerability is classified as high-severity and relates to a heap buffer overflow issue in the VP8 encoding of the open-source libvpx video codec library. Notably, this vulnerability has been exploited for the installation of spyware.

Swift Response to a Critical Threat

Google has promptly addressed the discovery of a fifth zero-day vulnerability in Chrome this year. The company acknowledged the existence of an exploit for CVE-2023-5217 in the wild, signifying the urgency of the situation.

Immediate Global Rollout of the Security Update

The security update, Chrome version 117.0.5938.132, has been deployed worldwide for Windows, Mac, and Linux users through the Stable Desktop channel. While it may take some time to reach all users, it was immediately available upon release, ensuring swift protection.

Zero-Day Exploitation for Spyware

The identified zero-day vulnerability (CVE-2023-5217) is categorized as high-severity due to a heap buffer overflow weakness within the VP8 encoding of the libvpx video codec library.

This flaw can result in various consequences, from application crashes to arbitrary code execution.

Ongoing Vigilance Against Cyber Threats

Google’s Threat Analysis Group (TAG) plays a critical role in identifying and reporting zero-day vulnerabilities that are exploited in targeted cyber espionage campaigns. These threats often target individuals of interest, such as journalists and political figures.

Conclusion: Safeguarding Browser Security

The rapid response to this zero-day vulnerability underlines the continuous efforts required to maintain the security of popular web browsers like Chrome.

Google’s commitment to timely updates is crucial in mitigating threats and protecting users from malicious exploitation.

About Google Threat Analysis Group (TAG): Google TAG is a specialized security research team dedicated to uncovering and reporting on advanced cyber threats, including zero-day vulnerabilities. Their work is vital in countering sophisticated cyberattacks and enhancing online security.