Google Issues Third Emergency Fix for Chrome This Year (theregister.com) 24
Google is issuing fixes for two vulnerabilities in its Chrome web browser, including one flaw that is already being exploited in the wild. From a report: The emergency updates the company issued this week impact the almost 3 billion users of its Chrome browser as well as those using other Chromium-based browsers, such as Microsoft Edge, Brave and Vivaldi. It is the third such emergency update Google has had to issue for Chrome this year. One of the flaws is a type confusion vulnerability tracked as CVE-2022-1364, a high-severity, zero-day bug that is actively being used by attackers. With a type confusion flaw, a program will allocate a resource like a pointer or object using one type but later will access the resource using another, incompatible type. In some languages, like C and C++, the vulnerability can result in out-of-bounds memory access. This incompatibility can cause a browser to crash or trigger logical errors. However, if exploited, it could enable a hacker to execute arbitrary code.
more competition (Score:5, Insightful)
This is why we need more competition in browsers.
Re:more competition (Score:4, Insightful)
Building a browser is hard and expensive, and no one wants to pay for it. That does not change the fact that the world would benefit from more browser competition.
Re: (Score:2)
Why isn't it modded insightful? Lack of solution approaches?
Anyway, I would have worded my response as "In diversity there is also strength".
However in terms of solutions, the lack of diversity could actually be a good thing. If only the dominant players would focus on the money that is motivating the serious criminals. Instead, they focus on their own money and increasing their own profits and "Live and let scam" should be the corporate motto for all the big corporations I know of.
Proof and disproof of con
Re: (Score:2)
We have several, but they need to be better. However, Edge is not really a competitor since it uses Chromium too.
Re: (Score:2)
Until someone else makes a chromium competitor we are pretty much stuck with chrome/chromium and firefox. There are a number of large tech companies that can afford to do it.
Re: (Score:2)
Safari. Ha, MS couldn't do it and switched to Chromium. :(
Spin ! (Score:2)
OMG Google fixed another BUG... Google BAD!
Haters gonna hate...
Wait, wait... (Score:1)
Re: Wait, wait... (Score:2)
AFAIK rust is not currently being used in chrome at all.
Re: Wait, wait... (Score:2)
Chrome leadership looked at Rust a couple of years back and then decided not to use it. Interestingly, none of the decision makers had ever used Rust seriously, and none of them produce much code of any sort anymore.
I got your emergency fix SWINGING, Google. (Score:1)
Re: (Score:3)
Yeah, Firefox has a lock on security. [mozilla.org] It has no vulnerabilities, right?
Re: (Score:1)
What exactly they did? (Score:2)
Re: (Score:3)
Google is not allowing their github repository for the bug fix to be viewed by the public, so we won't know the actual cause of the errors for a while. I'm getting a permission denied error while trying to view the bug fix, and Google's page says they are restricting access to the bug information until the majority of Chrome users have updated.
I wish people would realize (Score:3)
If Google is pushing out zero-day fixes, it's a good thing. While we know they've addressed CVE-2022-1364 [googleblog.com] that other zero-day vulnerabilities will be found. As long as there are bad actors including governments who want to compromise your systems and data they will find use any vector available. I find it refreshing that they actually came up with a fix and released it within two days. I'm also wondering how long the exposure would have been available to bad actors?
The Trifecta of "Could" (Score:2)
In some languages [...] the vulnerability can result in out-of-bounds memory access. This incompatibility can cause a browser to crash or trigger logical errors. However, if exploited, it could enable a hacker to execute arbitrary code.
I could also win the lottery three times in a row.
Not that kind of could (Score:3)
This context is more like a car could be driven to the grocery store, it could be driven to the hardware store, it could be driven to school.
Bad guys can use type confusions to do bad things, in the same way they can use cars to go to bad places. In this case, bad guys ARE using this particular one to do bad things. That's why it's posted here.
On Tuesday, Microsoft released patches (or partial patches) for 117 vulnerabilities in Windows, plus 17 in Edge. Any of those could be used by bad guys to do bad th
Re: (Score:3)
You mean like Rust?
Slashdotters have this idea, mostly spread by people like Angle O' Shit and The Evil Analingist, who range from shit programmers (as in angle, who uses linked lists every time he needs a collection) to people with little to no experience at all with compiled languages (as in evilatheist,) where they're convinced that everything you do in Rust requires unsafe, when it doesn't, and in fact it's really rare to need it at all, and they also repeat the idea that unsafe Rust is somehow just as
Electron Too, Teams and Slack? (Score:2)
Would this affect not just the Chromium browser, but also anything using Chromium, like Electron apps? That might be real target, stuff like Teams and Slack
Re: (Score:2)
Depends on whether you can feed the bad JS code through Teams and slack.
type confusion (Score:1)