Google Patches Major Zero-Day Vulnerability in Chrome

The Chrome exploit is used in attacks that leverage a waterhole-style injection in a Korean-language news portal.

Google Patches Major Zero-Day Vulnerability in Chrome

A new exploited vulnerability in Google Chrome web browser called "CVE-2019-13720", which is a zero-day vulnerability, has been spotted by Russian cyber-security firm Kaspersky. The firm has reported it Google and a patch has been released. Zero-day vulnerabilities are essentially previously unknown software bugs that can be exploited by attackers to inflict serious and unexpected damage. The detected exploit was used in what the cyber-security firm calls 'Operation WizardOpium'.

Certain similarities in the code point to a possible link between this campaign and Lazarus attacks.

"The finding of a new Google Chrome zero-day in the wild once again demonstrates that it is only collaboration between the security community and software developers, as well as constant investment in exploit prevention technologies, that can keep us safe from sudden and hidden strikes by threat actors," Anton Ivanov, Security Expert at Kaspersky, said in a statement.

The new exploit is used in attacks that leverage a waterhole-style injection in a Korean-language news portal. A malicious JavaScript code is inserted in the main page, which in turn, loads a profiling script from a remote site to further check if the victim's system could be infected by examining versions of the browser's user credentials.

The vulnerability tries to exploit the bug through the Google Chrome browser and the script checks if version 65 or later is being used.

The exploit gives an attacker a Use-After-Free (UaF) condition, which is very dangerous because it can lead to code execution scenarios.


For the latest tech news and reviews, follow Gadgets 360 on X, Facebook, WhatsApp, Threads and Google News. For the latest videos on gadgets and tech, subscribe to our YouTube channel. If you want to know everything about top influencers, follow our in-house Who'sThat360 on Instagram and YouTube.

Further reading: Google Chrome, Kaspersky
Realme Says Shipped 5.2 Million Smartphones in Festive Season Sales Last Month
PUBG Mobile Season 10 Tipped to Introduce New Character Called Sara With Vehicle Reinforcement Skill
Share on Facebook Gadgets360 Twitter Share Tweet Snapchat Share Reddit Comment google-newsGoogle News


Follow Us
© Copyright Red Pixels Ventures Limited 2024. All rights reserved.
Trending Products »
Latest Tech News »