Google addresses Chrome zero-day flaw actively exploited in the wild

Google has addressed an actively exploited zero-day vulnerability, tracked as CVE-2021-21148, with the release of the Chrome 88.0.4324.150 version.

Google released Chrome 88.0.4324.150 version that addressed an actively exploited zero-day security vulnerability.

The vulnerability is a Heap buffer overflow that resides in the V8, which is an open-source high-performance JavaScript and WebAssembly engine, written in C++.

The flaw was rated by Google as high severity, it was reported by Mattias Buelens on January 24th, 2021.

The 88.0.4324.150 version of the Stable channel will be available for Windows, Mac and Linux in the coming days/weeks.

“CVE-2021-21148: Heap buffer overflow in V8. Reported by Mattias Buelens on 2021-01-24.” reads the announcement published by Google.

“Google is aware of reports that an exploit for CVE-2021-21148 exists in the wild. We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.”

Google did not share details about the attacks and the attackers.

“Access to bug details and links may be kept restricted until a majority of users are updated with a fix.” Google adds. “We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”

In 2020, Google addresses five Chrome zero-days actively exploited in the wild.

In October, the IT giant addressed the following three zero-days:

• CVE-2020-15999 – The flaw is a memory corruption bug that resides in the FreeType font rendering library, which is included in standard Chrome releases.
• CVE-2020-16009 – is a Heap buffer overflow in Freetype in Google Chrome.
• CVE-2020-16010 – affects the browser’s user interface (UI) component in Chrome for Android.

In November, the company addressed two other zero-day vulnerabilities, actively exploited in the wild.

Both zero-day flaws, tracked as CVE-2020-16013 and CVE-2020-16017, were reported by anonymous sources.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Chrome zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]