Google has confirmed that a Chrome browser patch released last week was a fix for a critical flaw that was being exploited by criminals to inject malware onto a user’s device.
The company is urging Chrome users to immediately update their web browsers to the latest version, released last week, in light of the discovery of a zero-day vulnerability rated ‘highly severe’.
The flaw, termed CVE-2019-5786, is a memory mismanagement bug in Chrome’s FileReader, an API included in all web browsers that allows apps to read files stored on a user’s device or PC.
Its nature as a ‘use-after-free’ error means it tries to access memory after it has been deleted from Chrome’s allocated memory and, through this mechanism, could lead to the execution of malicious code.
“According to the official release notes, this vulnerability involves a memory mismanagement bug in a part of Chrome called FileReader,” said Sophos’ security proselytiser Paul Ducklin.
“That’s a programming tool that makes it easy for web developers to pop up menus and dialogues asking you to choose from a list of local files, for example when you want to pick a file to upload or an attachment to add to your webmail.”
“When we heard that the vulnerability was connected to FileReader, we assumed that the bug would involve reading from files you weren’t supposed to. Ironically, however, it looks as though attackers can take much more general control, allowing them to pull off what’s called Remote Code Execution.”
This breed of attack means cyber criminals could inject malware onto unsuspecting users’ machines without any warning, or seize full control of a device.
The vulnerability was discovered by Clement Lecigne of Google’s threat analysis group on 27 February. Google’s technical program manager Abdul Syed said that the company has become aware of active exploits in the wild, but provided no further information as to the nature of these or who had been targeted.
Google initially released the fix on Friday 1 March, but updated its original announcement to provide further details around the flaw.