Slashdot is powered by your submissions, so send in your scoop

 


Forgot your password?
Close
typodupeerror
×
Security Chrome The Internet

Google Chrome Hit In Another Mysterious Zero-Day Attack (securityweek.com) 62

Posted by BeauHD from the time-to-update dept.
wiredmikey shares a report from SecurityWeek: Google late Tuesday shipped another urgent security patch for its dominant Chrome browser and warned that attackers are exploiting one of the zero-days in active attacks. This is the fourth in-the-wild Chrome zero-day discovered so far in 2021 and the continued absence of IOC data or any meaningful information about the attacks continue to raise eyebrows among security experts.

The newest Chrome update -- 90.0.4430.85 -- is available for Windows, Mac and Linux users and is being rolled out via the browser's automatic update mechanism. The vulnerability being exploited is identified as CVE-2021-21224 and simply described as a "type confusion" in the V8 Chrome rendering engine. Google credited the Jose Martinez (tr0y4) from VerSprite Inc. for reporting the vulnerability. "Google is aware of reports that exploits for CVE-2021-21224 exist in the wild," the company said, with no additional details.
This discussion has been archived. No new comments can be posted.

Google Chrome Hit In Another Mysterious Zero-Day Attack More

Google Chrome Hit In Another Mysterious Zero-Day Attack

Comments Filter:

  • Yay monoculture (Score:1)

    by Anonymous Coward

    I assume that other browsers based on the same rendering engine, such as Edge, are also vulnerable.

  • We wanted to do everything including emulate Windows 98 in a web browser, meaning we got so much attack surface. Fix one bug and there will be thousands more to be exploited. Game consoles stopped including browsers because they made it too easy to pirate games with them.

    It gets worse because the auto update function in browser malfunctions a lot. If you look at the csv data on statcounter you can see a large amount of browsers stuck on old versions, as much as 15% of browsers are stuck this way.

    Most

    • No, actually, Google just wanted to kill competitors. It was never about the features. We already had those. It's called an OS.

    • You seem to be inventing “facts” to suit your predetermined narrative.

      For instance, what does any of this have to do with HTML5? V8 is Chrome’s JavaScript engine [wikipedia.org]. This same bug could have presumably happened with any previous version of HTML. Calling out of HTML5 in particular makes it seem as if you have an axe to grind.

      Likewise, Windows 98 debuted a few years after Microsoft had already adopted HTML and JavaScript, so your implication that these technologies were created because we wante

      • Re: (Score:2)

        by tlhIngan ( 30335 )

        Calling out of HTML5 in particular makes it seem as if you have an axe to grind

        Well, HTML5 is a bit complex, but it's one of those necessary complexities. I mean, it really boils down back to the App vs. Web debate. Do you want to force everyone to watch Netflix using an app? Or to compartmentalize the internet into a series of apps? Or do you want it to be (somewhat*) open in that anyone with a web browser can access useful information, rather than the browser serving as a launch point to install and run a

    • Game consoles stopped including browsers because they made it too easy to pirate games with them.

      Uhh, that doesn't sound right, the PS3 and PS4 had browsers, not sure about the 5, the XBox 360 had IE... do you have any reference to back this up? Genuinely curious here, I've never heard that claim before.

  • Just another reason to not use/ trust Chrome.

  • Mysterious zero-day, which is simiply not true as there is a patch

    • Re: Very sensationalist headline (Score:5, Informative)

      by BAReFO0t ( 6240524 ) on Wednesday April 21, 2021 @07:52AM (#61296804)

      Zero-day means "on the day of release".
      This implies it was exploited since day zero.
      Certainly, the patch didn't come out at the day of release.
      A patch doesn't go back in time and make it not exploited on day zero. It just stops is from the day you actually install the patch. (IFF it works. MS taught us it can also make it worse.)

  • Who pays for people to look or find these vulns ? TO fnd one takes many people to look, and who pays people to look for these things ?

    • It appears to be a complex market full with brokers and even published prices. Linking to https://yro.slashdot.org/story/20/04/15/2129249/hackers-are-selling-a-critical-zoom-zero-day-exploit-for-500000 [slashdot.org] just as one data point but a simple google search reveals tons of sites and prices.

      If you mean how white hats learn about these: many companies (I think Google included) even have rewards for that (it's after all finding bugs in their software), plus they have tons of programmers (just because it's their trad

      • > If you mean how white hats learn about these: many companies (I think Google included) even have rewards for that (it's after all finding bugs in their software),

        That doesnt add up. Just think maybe 1 in 100 researches actually finds something . The other 99 could spend months and in the end get nothing.

        • Obviously these 99 (and probably the 100th one too) don't rely on getting a reward for a living if that's what you are getting at.

          • So why reply with such a stupid answer that they live from bounties, when its obvious that 99% never win any bounty and the one who does, well most of the time the bounties are terrible considering the time and effort.
          • The chances in finding a bounty are not that far from winning a lottery and almost as stupid.

    • Not everyone needs to be paid to do a task if they find it fun. A lot of people see exploit hunting the same way other people might see doing a crossword puzzle, mountain climbing, or playing a PC game all day. It is fun to randomly go through bits of code and see what it does, how it works, and check for exploitability. There are so many tutorials and puzzles to teach and challenge you when it comes to looking for exploits.

      • > Not everyone needs to be paid to do a task if they find it fun. A lot of people see exploit hunting the same way other people might see doing a crossword puzzle, mountain climbing, or playing a PC game all day
        Thats all true but to find exploits you require time, considerable time. We are talking testing this and that on a daily basis. You dont just find an exploit after spending an evening or two. New releases of C come out all the time, which again means you need to recheck etc all the time.
        This i

  • Chrome is the new Windows.

    That's what you get for adding an endless stream of useless kitchen sinks just to kill all the competitors. Now they're not so usless anymore! ;)

    • Re: (Score:2)

      by Merk42 ( 1906718 )
      I'm curious to know what Browser/OS you use that has never had a Zero-Day in its existence.

      • Re: (Score:2)

        by clovis ( 4684 )

        I'm curious to know what Browser/OS you use that has never had a Zero-Day in its existence.

        yeah, even Lynx had a few serious bugs. I don't know if any were ever exploited.

    • Re: (Score:2)

      by geek ( 5680 )

      Chrome is the new Windows.

      That's what you get for adding an endless stream of useless kitchen sinks just to kill all the competitors. Now they're not so usless anymore! ;)

      Feel free to develop an alternative. We're waiting

  • Chrome would do well to allow end users to spin up their own builds. Much like building your own linux kernel specific to your needs. If you could actually purge a pile of stuff you never use but is included for other reasons; you increase security by reductions to code. Chrome is much too large and the attack surface is unprotectable and unpredictable. Remember it is easier to attack then to defend.

  • Latest version of Chromium available for Mint 20.1 remains at 89.0.4389.114.

  • Is that a typo or some style of address with which I am unfamiliar?
  • You wants the short but memorable relations. We will have fun this night! I'm waiting >> http://gg.gg/oa9py [gg.gg]

  • Chrome is superior to all others because it has a security sandbox. That's what they've always told us.

    These are not the zero-days you're looking for...

  • OpenBSD pledge Chrome (Score:3)

    by emil ( 695 ) on Wednesday April 21, 2021 @11:25AM (#61297348)

    I wonder if OpenBSD's hardened Chrome [undeadly.org] is vulnerable to these exploits.

    OpenBSD's kernel is configured to kill any Chrome process that violates behavior prohibited by pledge().

  • ewrewrerewrw

Slashdot Top Deals

And it should be the law: If you use the word `paradigm' without knowing what the dictionary says it means, you go to jail. No exceptions. -- David Jones

Close