Google Releases Chrome Emergency Fix
For Ninth Zero-Day This Year

Google developers introduced an urgent resolve for Chrome 108..5359.94 on Friday. The update addresses a novel, zero-day vulnerability (tracked CVE-2022-4262).

The flaw reportedly affects all variations of the browser, and in accordance to Mike Walters, VP of vulnerability and threat investigate at Action1, the fix was urgent, as there is currently a performing exploit for it. 

“This take care of addresses the ninth zero-working day vulnerability in the browser this 12 months. Also, it carries on an odd sample of Google repairing a zero-working day vulnerability quickly just after a common release,” Walters instructed Infosecurity.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

As is customary for Google, information on the vulnerability and exploit have nonetheless to be released.

“Google will not give particulars about the vulnerability until finally most users’ browsers are updated, and rightly so,” Walters explained. “The severity of this vulnerability can rarely be overstated. That is why we endorse that you update your Chrome browser as shortly as probable.”

While information about the flaw are not publicly identified, it is recognised that it is connected to type confusion bugs in the V8 JavaScript engine.

“Accordingly, it is extremely most likely that this vulnerability makes it possible for remote code execution, which implies that a threat actor could lead to any script or malware payload to be executed on the victims’ system,” Walters stated.

“In most conditions, attackers exploit these kinds of vulnerabilities when end users go to their malicious website. Then they steal facts from the impacted devices or produce botnets to execute dispersed denial-of-assistance (DDoS) attacks, mine cryptocurrency or mail spam.”

At the same time, patching browsers can be problematic, Walters said, considering that people today do not like rebooting their browsers, which is usually required as section of an update.

“Which is why the ideal exercise for companies is to automate patching for 3rd-party apps, such as browsers, and ensure their IT groups can drive reboots remotely in a way that is at ease to stop customers,” the government concluded.

The patch will come a lot less than two weeks from Google’s most recent Chrome patch for a zero-day (tracked CVE-2022-4135), which the tech huge dealt with on November 24.