Experts Explain a New RCE Vulnerability in the Google Chrome Dev Channel

Experts Explain a New RCE Vulnerability in the Google Chrome Dev Channel ,Details have emerged concerning a newly fixed serious remote code execution vulnerability in Google Chrome and Chromium-based browsers’ V8 JavaScript and WebAssembly engines.

The problem is related to an instance of use-after-free in the instruction optimization component. Which if successfully exploited might “enable an attacker to execute arbitrary code in the context of the browser.”

The bug. Discovered in Chrome 101’s Dev channel. Was reported to Google by Weibo Wang. A security researcher at Singapore cybersecurity firm Numen Cyber Technology. And has since been discreetly corrected by the company.

“This vulnerability arises at the instruction selection step. Where the incorrect instruction is chosen. Resulting in a memory access exception.” Wang explained.

When previously-freed memory is accessed, it causes uncertain behavior and can cause a program to crash. Utilize corrupted data. Or even execute arbitrary code.

Worryingly, the issue may be remotely exploited via a properly crafted website to circumvent security constraints and run arbitrary code to compromise the targeted computers.

“This vulnerability may be further exploited utilizing heap spraying techniques, resulting in a ‘type confusion’ issue,” Wang added. “The vulnerability allows an attacker to manipulate function pointers or put code into arbitrary memory regions, potentially leading to code execution.”

To allow as many people as possible to install the patched version first, the business has not yet revealed the vulnerability via the Chromium bug tracker web. Google also does not give CVE IDs to vulnerabilities discovered in non-stable Chrome channels.

Chrome users. Particularly developers who use Chrome’s Dev edition for testing to ensure that their apps are compatible with the newest Chrome features and API modifications. Should update to the most recent version of the program.

TurboFan

assembly instructions once the vulnerability has been fixed

This is not the first time that Chrome has been found to contain use-after-free vulnerabilities. Google patched seven such issues in the web browser that were exploited in real-world assaults in 2021. This year, it has also set an actively exploited use-after-free vulnerability in the Animation component.

Have you enjoyed reading this article? To read more exclusive material. Follow us on Facebook.  Experts Explain a New RCE Vulnerability in the Google Chrome Dev Channel