The term exploited refers to when a software bug is being taken advantage of for malicious purposes, like when remote code execution is used to target vulnerable systems -which is the case for this particular Chrome vulnerability.
Google Chrome’s Track Record
Google Chrome’s track record, objectively speaking, is not too pretty both in terms of outright cybersecurity and user data privacy. Namely, a steady flow of browser code vulnerabilities, data confidentiality issues, even problems extending to extensions stealing crypto wallet keys have been noted in the past.
About The Exploited Google Chrome Vulnerability
A software vulnerability report was posted on Google’s proprietary Chrome security blog ‘Chrome Releases’ on September 24th, 2021. The report details a remote code execution security risk within Google’s Chrome browser. The vulnerability, named CVE-2021-37973 in the public CVE database is classified as a critical risk.
Technical Details
This vulnerability was categorized as a use-after-free type. The vulnerability allows a remote attacker to compromise a vulnerable (unpatched) system. The vulnerability exists due to a use-after-free error when processing HTML content within the Portals component in Google Chrome. A remote attacker can create a specially crafted website, trick the victim into visiting it, trigger a use-after-free error and execute arbitrary code on the system. Successful exploitation of the vulnerability may allow an attacker to compromise an unpatched system.
Vulnerable Software Versions
The versions of Google Chrome that are currently vulnerable to this security issue are;
Important Informations For Users
Chrome users need to know that a patch has been released that mitigates the issue. This software vulnerability is being actively exploited in the wild, which means that users should immediately update their Google Chrome release so that the continued safety and stability of the browser are possible. Official information from Google about the fixed release states that “The Stable channel has been updated to 94.0.4606.61 for Windows, Mac, and Linux which will roll out over the coming days/weeks.” Users must ensure that automatic updates are enabled on both their operating system as well as the Google Chrome app itself. Alternatively, users can pick up the latest, fixed release of Google Chrome here. A full log describing all the changes in the software update can be found on this page.
