New Chrome Zero-Day Under Active Attacks – Update Your Browser

Google has patched a second actively exploited zero-day flaw in the Chrome browser in two weeks, along with addressing nine other security vulnerabilities in its latest update.

The company released 86.0.4240.183 for Windows, Mac, and Linux, which it said will be rolling out over the coming days/weeks to all users.

The zero-day flaw, tracked as CVE-2020-16009, was reported by Clement Lecigne of Google’s Threat Analysis Group (TAG) and Samuel Groß of Google Project Zero on October 29.

The company also warned that it “is aware of reports that an exploit for CVE-2020-16009 exists in the wild.”

Google hasn’t made any details about the bug or the exploit used by threat actors public so as to allow a majority of users to install the updates and prevent other adversaries from developing their own exploits leveraging the flaw.

But Ben Hawkes, Google Project Zero’s technical lead, said CVE-2020-16009 concerned an “inappropriate implementation” of its V8 JavaScript rendering engine leading to remote code execution.

Aside from the ten security fixes for the desktop version of Chrome, Google has also addressed a separate zero-day in Chrome for Android that was being exploited in the wild — a sandbox escape flaw tracked as CVE-2020-16010.

The zero-day disclosures come two weeks after Google fixed a critical buffer overflow flaw (CVE-2020-15999) in the Freetype font library.

Then late last week, the company revealed a Windows privilege escalation zero-day (CVE-2020-17087) that was employed in combination with the above font rendering library flaw to crash Windows systems.

The search giant hasn’t so far clarified if the same threat actor was exploiting the two zero-days.