Further, the Chrome Extended Stable channel has been updated to 1.148 for Windows and Mac to fix CVE-2022-2294. In addition to Chrome for Windows, the fixes were also released in Chrome for Android version 1.71 for CVE-2022-2294 and CVE-2022-2295. It might also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.īesides fixing the zero-day buffer overflow flaw, Google on Monday also released a patch to fix two other high-severity flaws, which include a type confusion bug in the V8 JavaScript engine tracked as CVE-2022-2295 and a use-after-free flaw in Chrome OS Shell tracked as CVE-2022-2296. Google says it doesn’t reveal details about the exploits or the vulnerabilities until a majority of users are updated with a fix. “Google is aware that an exploit for CVE-2022-2294 exists in the wild,” according to Google’s Monday security advisory for Windows. “The Stable channel has been updated to 1.114 for Windows, which will roll out over the coming days/weeks.” If exploited, this vulnerability may allow denial-of-service attacks or, in some cases, arbitrary code execution on your desktop, which has the potential to give hackers full access to your PC. The high-severity vulnerability (CVE-2022-2294) is a heap buffer overflow bug, which exists in WebRTC, the engine that gives the browser its real-time communications capability. High CVE-2022-2296: Use after free in Chrome OS Shell.Reported by Jan Vojtesek from the Avast Threat Intelligence team on High CVE-2022-2294: Heap buffer overflow in WebRTC.Chrome for Windows has been updated to version 1.114, which includes four security fixes, of which three were highlighted by Google that were contributed by external researchers:
0 kommentar(er)
