GOOGLE FIXED THE FOURTH CHROME ZERO-DAY OF 2023

Google rolled out emergency security updates to address a new Chrome zero-day (CVE-2023-4863) actively exploited in the wild.

Google rolled out emergency security updates to address a zero-day vulnerability that has been actively exploited in attacks in the wild since the start of the year.

The vulnerability, tracked as CVE-2023-4863, is the fourth actively exploited zero-day fixed by Google in 2023.

The flaw CVE-2023-4863 is a critical heap buffer overflow that resides in the WebP. The issue was reported to the IT giant by Apple Security Engineering and Architecture (SEAR) and The Citizen Lab at The University of Torontoʼs Munk School on 2023-09-06.

“We would also like to thank all security researchers that worked with us during the development cycle to prevent security bugs from ever reaching the stable channel.” reads the announcement made by Google. “Google is aware that an exploit for CVE-2023-4863 exists in the wild.”

According to the advisory, the Stable and Extended stable channels have been updated to 116.0.5845.187 for Mac and Linux and 116.0.5845.187/.188 for Windows, which will be released over the coming days/weeks.

As usual, Google did not publicly share details of the attacks, however, the fact that the issue was reported by Citizen Lab suggests that the vulnerability may have been exploited in attacks against high-profile individuals such as journalists or dissidents.

This year Google already addressed the following actively exploited zero-day flaws in Chrome:

• CVE-2023-2033 (CVSS score: 8.8) – Type Confusion in V8
• CVE-2023-2136 (CVSS score: 9.6) – Integer overflow in the Skia graphics library
• CVE-2023-3079 (CVSS score: 8.8) – Type Confusion in V8

Follow me on Twitter: @securityaffairs and Facebook and Mastodon

Pierluigi Paganini

(SecurityAffairs – hacking, Chrome)