A team of cybersecurity experts revealed a proof of concept (PoC) for exploiting a severe vulnerability residing in Chrome, Edge and other browsers based on the Chromium project, the open source web browser developed by Google.
This PoC was presented by Bruno Keith and Niklas Baumstark during the Pwn2Own ethical hacking contest, and consists of a remote code execution exploit that works against browsers based on the Chromium project and its exploitation requires taking the target user to a specially designed website. Investigators received a $100,000 USD reward for their report.
After receiving the report Google announced that it would start working on the release of a patch, although it has not been released. However, an independent researcher published a report mentioning that Google made an almost imperceptible change to Chromium’s JavaScript v8 engine to mitigate the risk of exploitation.
Apparently the exploit launched by researchers only works if the sandbox of the target system is disabled, plus it is required to chain a sandbox escape vulnerability for attack against a system with default settings: “It is also possible to use this exploit without a sandbox escape to achieve a universal XSS attack, which can be used to access registered accounts” , the researchers explain.
During their presentation, experts said they had tested the exploit on Chrome and Edge, although they note that it is highly likely that the attack could be replicated in other Chromium-based browsers, including Opera and Brave. In the meantime, it is ignored whether the next version of Chrome, intended to be released earlier this week, includes mitigation mechanisms for this flaw.
Finally, cybersecurity experts point out that this could be one of those cases where open source software failures can be exploited while developers prepare the necessary security patches, so it’s critical that Google release a Chromium update immediately. To learn more about information security risks, malware, vulnerabilities and information technologies, feel free to access the International Institute of Cyber Security (IICS) websites.
He is a well-known expert in mobile security and malware analysis. He studied Computer Science at NYU and started working as a cyber security analyst in 2003. He is actively working as an anti-malware expert. He also worked for security companies like Kaspersky Lab. His everyday job includes researching about new malware and cyber security incidents. Also he has deep level of knowledge in mobile security and mobile vulnerabilities.
