For the second time in a week, a Google Chromium zero-day released online

For the second time in a week, a Chromium zero-day remote code execution exploit code has been released on Twitter, multiple browsers impacted.

A new Chromium zero-day remote code execution exploit has been released on Twitter this week, like the previous one that affects current versions of Google Chrome, Microsoft Edge, and likely other Chromium-based browsers.

The exploit for the new vulnerability was publicly released by a security researcher that goes online with the handle frust. The exploit demonstrated by the expert triggers the issue to open the Windows Notepad application.

Early this week, the Indian security researcher Rajvardhan Agarwal has publicly released a proof-of-concept exploit code for a recently discovered vulnerability that affects Google Chrome, Microsoft Edge, and other Chromium-based browsers (i.e. Opera, Brave).

The researchers uploaded the PoC code on GitHub and announced its availability via Twitter. According to The Record, the PoC code released by the experts was the same exploited by the security duo composed of Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow during the Pwn2Own 2021 hacking contest.

Google addressed this issue with the release of the Chrome 89.0.4389.128 version.

Both remote code execution vulnerabilities disclosed this week could not escape Chromium’s sandbox, which means that attackers have to chain them with a sandbox escape exploit to executing arbitrary code on the underlying system.

Since January, Google has already addressed other zero-day issues in Chrome that have been actively exploited in the wild, including CVE-2021-21148, CVE-2021-21166, and CVE-2021-21193.

If you want to receive the weekly Security Affairs Newsletter for free subscribe here.

Follow me on Twitter: @securityaffairs and Facebook

[adrotate banner=”9″]

[adrotate banner=”12″]

Pierluigi Paganini

(SecurityAffairs – hacking, Chromium zero-day)

[adrotate banner=”5″]

[adrotate banner=”13″]

Pierluigi Paganini

Pierluigi Paganini is member of the ENISA (European Union Agency for Network and Information Security) Threat Landscape Stakeholder Group and Cyber G7 Group, he is also a Security Evangelist, Security Analyst and Freelance Writer. Editor-in-Chief at "Cyber Defense Magazine", Pierluigi is a cyber security expert with over 20 years experience in the field, he is Certified Ethical Hacker at EC Council in London. The passion for writing and a strong belief that security is founded on sharing and awareness led Pierluigi to find the security blog "Security Affairs" recently named a Top National Security Resource for US. Pierluigi is a member of the "The Hacker News" team and he is a writer for some major publications in the field such as Cyber War Zone, ICTTF, Infosec Island, Infosec Institute, The Hacker News Magazine and for many other Security magazines. Author of the Books "The Deep Dark Web" and “Digital Virtual Currency and Bitcoin”.