Google released an update for its Chrome web browser some hours ago that fixes several vulnerabilities. One of these, CVE-2023-6345, is exploited in the wild according to Google.
Chrome users may want to update the browser asap to protect their browser against potential attacks. Updates are applied automatically over time on most user systems, but it may take days or even weeks before it lands on some devices.
Cautious users may want to speed up the process by selecting Menu > Help > About Google Chrome. The page that opens list the current version and installs any new version that is available, provided that there is an Internet connection. A restart completes the update.
The browser should now list one of the following versions on the page:
- Chrome for Mac and Linux: 119.0.6045.199
- Chrome for Windows: 119.0.6045.199 or 119.0.6045.200
- Chrome Extended Stable for Mac and Windows: 118.0.5993.159
- Chrome for Android: 119.0.6045.193
Chrome's 6th 0-day security issue in 2023
Google reveals that it patched seven security issues in the Chrome update. Of these, six are listed on the official release notes page on the Chrome Releases website.
Besides the vulnerability that is exploited in the wild, Google lists five additional security issues that it patched. Four of these have a high severity rating. Two issues, including the one that is exploited in the wild, have no severity rating at the time.
The issue that is exploited in the wild exists in Skia. Skia is an open source 2D graphics library. Chrome users it as its graphics engine, which makes it a major component of the web browser.
The five remaining vulnerabilities address use after free, out of bounds memory access and type confusion vulnerabilities in a variety of components, including spellchecking, WebAudio or libavif, a library for encoding and decoding avif files.
Closing Words
Other Chromium-based web browsers are affected by the vulnerabilities as well. Expect updates for Microsoft Edge, Brave, Opera or Vivaldi in the coming hours and days.
Now You: do you use a Chromium-based browser?
