{"id":1731532,"date":"2022-10-29T11:08:55","date_gmt":"2022-10-29T15:08:55","guid":{"rendered":"https:\/\/wordpress-1016567-4521551.cloudwaysapps.com\/?post_type=station&p=1731532"},"modified":"2022-10-29T18:38:23","modified_gmt":"2022-10-29T22:38:23","slug":"chrome-issues-urgent-zero-day-fix-update-now","status":"publish","type":"station","link":"https:\/\/platodata.io\/plato-data\/chrome-issues-urgent-zero-day-fix-update-now\/","title":{"rendered":"Chrome issues urgent zero-day fix \u2013 update now!"},"content":{"rendered":"
<\/div>\n
\n
\n

\t\t\t\t\tby<\/span>
\n\t\t\tPaul Ducklin<\/a>\t\t<\/p><\/div><\/div>\n

Google pushed out a bunch of security fixes for the Chrome and Chromium browser code earlier this week\u2026<\/p>\n

\u2026only to receive a vulnerability report from researchers at cybersecurity company Avast on the very same day.<\/p>\n

Google\u2019s response was to push out another update<\/a> as soon as it could: a one-bug fix dealing with CVE-2022-3723,<\/strong> described with Google\u2019s customary we-can-neither-confirm-nor-deny legalism saying:<\/p>\n

\n

Google is aware of reports that an exploit for CVE-2022-3723 exists in the wild.<\/p>\n<\/blockquote>\n

(Apple also regularly uses a similarly disengaged flavour of OMG-everybody-there\u2019s-an-0-day notification, using words to the effect that it \u201cis aware of a report that [an] issue may have been actively exploited\u201d.)<\/p>\n

This Chrome update means that you\u2019re now looking for a version number of 107.0.5304.87<\/strong> or later. <\/p>\n

Confusingly, that\u2019s the version number to expect on Mac or Linux, while Windows users may get 107.0.5304.87<\/strong> or 107.0.5304.88<\/strong>, and, no, we don\u2019t know why there are two different numbers there.<\/p>\n

For what it\u2019s worth, the cause of this security hole was described as \u201ctype confusion in V8\u201d<\/em>, which is jargon for \u201cthere was an exploitable bug in the JavaScript engine that could be triggered by untrusted code and untrusted data that came in apparently innocently from outside\u201d.<\/p>\n

Loosely speaking, that means it\u2019s almost certain that merely visiting and viewing a booby-trapped website\u00a0\u2013 something that\u2019s not supposed to lead you into harm\u2019s way on its own\u00a0\u2013 could be enough to launch rogue code and implant malware on your device, without any popups or other download warnings.<\/p>\n

That\u2019s what\u2019s known in cybercrime slang as a drive-by install<\/em>.<\/p>\n