Google has released Chrome Version 117.0.5938.132 for Mac, Linux, and Windows to address several security vulnerabilities, including a zero-day vulnerability (CVE-2023-5217).
Based on the official site for Chrome updates, “Google is aware of reports that an exploit for CVE-2023-5217 exists in the wild”.
A. Nature of Vulnerabilities
- Heap buffer overflow in vp8 encoding in libvpx. Reported by Clément Lecigne of Google’s Threat Analysis Group on 2023-09-25
- Use after free in Passwords. Reported by [pwn2car] on 2023-09-05
- Use after free in Extensions. Reported by Thomas Orlita on 2023-08-25
B. Actions to be Taken
CERT-PH recommends the following actions be taken:
- Review and apply the necessary update to mitigate future threats.
- Go to Chrome Settings > Help > About Google Chrome
- For additional information, kindly refer to the official report