Multiple security vulnerabilities have been detected in ChromeOS that could allow remote attackers to execute code remotely and access sensitive information in affected installations.
The vulnerabilities include;
- Use-After-Free error affecting Google Chrome’s WebTransport component (CVE-2023-0471),
- Use-After-Free error affecting Google Chrome’s WebRTC component (CVE-2023-0472),
- Type Confusion errors affecting Google Chrome’s ServiceWorker API component (CVE-2023-0473), and
- Use-After-Free error affecting Google Chrome’s GuestView component (CVE-2023-0474).
Google has released updated versions to address these vulnerabilities, and it is recommended to apply the updates promptly to avoid being targeted by potential attacks.
What do the public records say?
All four flaws were published in the National Vulnerability Database on 30 January 2023, and each has a CVSS 3.1 base score of 8.8 (high). The records say that Google Chrome versions before 109.0.5414.119 are affected, so that is the fixed version to look for. Google rates the Chromium severity of the WebTransport and WebRTC flaws as High, and that of the ServiceWorker and GuestView flaws as Medium.
In the records, the first three flaws can be used by a remote attacker through a crafted HTML page, which could lead to heap corruption. The GuestView flaw (CVE-2023-0474) is different, because it needs a user to be convinced to install a malicious extension. See also the records for CVE-2023-0471, CVE-2023-0472 and CVE-2023-0473.
What do these bug types mean?
A use-after-free bug happens when a program keeps using a piece of memory after it has been released. An attacker can try to place their own data there, and that can corrupt memory and sometimes lead to code execution. A type confusion bug happens when the program treats an object as a different type than it really is, which can have a similar effect. Browsers handle untrusted web content all the time, so these bugs are common targets, and quick updates are the main defence.
What does Google say in its release notes?
The Chrome stable channel update of 24 January 2023 moved the browser to version 109.0.5414.119 on Mac and Linux, and 109.0.5414.119 or .120 on Windows. Google says the rollout takes place over the coming days and weeks. The update includes 7 security fixes. Google lists five of them as reported by outside researchers, and the other fixes came from its own internal audits and fuzzing. The fifth listed bug is CVE-2022-4926, an insufficient policy enforcement flaw in Intents, which this post does not cover. Google also says it may keep bug details restricted until most users have the fix.
What should you do?
Apply the update on every device that runs Chrome or ChromeOS, and check that the browser version is at least 109.0.5414.119 or the matching ChromeOS release. Be careful with unknown extensions, and remove the ones nobody uses.