Google is rolling out a new version of their Chrome web browser that fixes a remote code execution vulnerability that is under attack in the wild – the seventh zero day in Chrome so far this year.
The new version of Chrome (91.0.4472.114) on Linux, Windows, and Mac resolves four high severity vulnerabilities including CVE-2021-30554 which has exploit code available in the wild making it much more likely to come under attack.
In line with an increasingly common trend, Google is not publishing details of the vulnerabilities until the fixes have been widely deployed. By taking this approach, attackers are denied the assistance provided by the vulnerability description which can help them develop attacks against the code. The only information released so far is that the vulnerability is found in the WebGL Javascript API which Chrome uses to render graphics on a web page.
Google states that: Access to bug details and links may be kept restricted until a majority of users are updated with a fix.
Google Chrome should automatically update itself, however interested users can force it to check and update on demand by using the menu command: Settings > Help > ‘About Google Chrome’ in Windows or Chrome > About Google Chrome on Mac.
“We were very impressed with the service, I will say, the vulnerability found was one our previous organisation had not picked up, which does make you wonder if anything else was missed.”
Aim Ltd Chief Technology Officer (CTO)