Vulnerabilities in Google Chrome Exploited in the Wild

Summary

Zero-day vulnerabilities exist in both Google Chrome for Android and Desktop that are currently being exploited in the wild. The Chrome for Android heap buffer overflow vulnerability (CVE-2020-16010) was patched in a recent update to version 86.0.4240.185. Chrome for desktop vulnerabilities are also being exploited in the wild, including an inappropriate implementation flaw ( CVE-2020-16009 ) and another heap buffer overflow flaw (CVE-2020-15999), which is being exploited in conjunction with a Windows kernel flaw (CVE-2020-17087). The Chrome for desktop vulnerabilities were patched in version 86.0.4240.183 for Windows, Mac, and Linux. These vulnerabilities can be exploited to achieve remote code execution and escalate privileges.

Recommendations

The NJCCIC recommends users who do not have auto-updating on for Chrome update to version 86.0.4240.185 to patch all the above-mentioned vulnerabilities. For more information on the vulnerabilities, including CVE-2020-17087, review the Help Net Security article and Chromium blog post.