Google Pays Chrome Hackers $45,000, Releases High-Severity Security Update

In the present day is called ‘Exploit Wednesday’ as a result of it follows Patch Tuesday when big-name distributors launch a number of safety patches. I’ve already reported this morning how Microsoft confirmed a minimum of four new Windows zero-days being actively exploited within the wild. Whereas none are zero-days, Google is also rolling out an update to handle six high-severity safety points impacting the Chrome browser. 4 of those earned the hackers who reported them a complete of $45,000.

What are the six new high-severity Google Chrome CVEs?

With a complete of 10 safety points mounted on this newest replace to Chrome model 107.0.5304.110 for Mac and Linux and 107.0.5304.106/.107 for Home windows, six have been allotted Widespread Vulnerabilities and Exposures (CVE) scores of excessive.

These are:

• CVE-2022-3885, a use-after-free vulnerability within the V8 JavaScript engine, earned the reporting hacker, a safety researcher recognized as gzobqq@, a cool $21,000 bounty.
• CVE-2022-3886, one other use after free vulnerability however this time inside Chrome’s speech recognition system, was reported by a researcher who needs to stay nameless. Together with that anonymity being granted, they obtained a bounty of $10,000.
• CVE-2022-3887, additionally reported by a shy hacker, this time incomes $7,000, is a use-after-free vulnerability within the ‘internet staff’ script working system.
• CVE-2022-3888, a use-after-free vulnerability inside WebCodecs, was reported by Peter Nemeth, who additionally earned a $7,000 bounty.
• CVE-2022-3889, is a kind confusion vulnerability within the V8 engine, and CVE-2022-3890 is a heap buffer overflow within the Crashpad crash-reporting system. Each have been reported by hackers who want to stay nameless, and bounty funds have but to be confirmed.

MORE FROM FORBESWindows Security: Users Urged To Update As 4 New Zero-Day Attacks ConfirmedBy Davey Winder

Patch your functions with out undue delay, safety professional says

The entire vulnerabilities, Mike Walters, vice chairman of Vulnerability and Menace Analysis at Action1 explains, “might be exploited provided that a consumer visits a web site with malicious payloads, akin to by clicking on a hyperlink in a phishing e-mail or by means of careless looking.” Nonetheless, he recommends that customers “patch all of your Chrome functions with out undue delay.”

The Google Chrome safety updates for Home windows, Mac, and Linux customers will already be rolling out and will attain all customers inside the subsequent few days or even weeks. You’ll be able to kickstart the method by going to the Assist|About Chrome menu setting. This motion will verify if an replace is on the market and obtain it; the consumer simply must restart the browser to activate the patching. When you do nothing, the replace ought to arrive mechanically however, as earlier than, it should solely be activated as soon as the browser is restarted.

Customers of different standard Chromium-based browsers, akin to Courageous and Edge, also needs to verify to see if updates can be found or have been put in.

MORE FROM FORBESNo, Dropbox ‘Hacker’ Hasn’t Stolen Passwords Or Data Of 700 Million UsersBy Davey Winder