A new version of the Chrome desktop app has been released to the Chrome Stable Channel available for all platforms. Chrome version 109.0.5414.74 on Linux, 109.0.5414.74/.75 on Windows, and 109.0.5414.87 on Mac contain new Chrome 109 features, as well as security patches for 17 vulnerabilities, two of which are high severity flaws.  

CVE-2023-0128 is a use after free vulnerability, in which recently freed memory is reused, which can lead to the corruption of valid data, resulting in program crashes, or arbitrary code execution. This high severity vulnerability has a CVSS base score of 8.8/10 and can be exploited by a remote attacker, however user interaction is required. Occurring in the Overview Mode of Chrome OS, remote actors first need to craft a malicious HTML page that they can trick the user into interacting with. The user must then engage in specific UI interactions on this HTML page to result in heap corruption of the memory, possibly resulting in remote code execution.  

The other high severity vulnerability, tracked as CVE-2023-0129, has also been assigned a CVSS base score of 8.8/10. Similarly, this flaw also can be exploited through a heap corruption, however in this case it is through a heap buffer overflow. An attacker can trigger this out-of-bounds write to occur in the Network Service of Google Chrome again through user interaction only. The user must first install a malicious extension on their Chrome browser, which is accessed through a HTML page created and controlled by the attacker. After specific interactions are performed by the user on this HTML page the heap corruption can be performed, resulting in data corruption, a service crash, or code execution. 

Users can update the Google Chrome desktop app to the most recent version in order to apply the recent security patches and avoid the potential for these flaws to be exploited. To update Chrome, first open the browser, then click the three-dot menu (…) to open Settings. Within Settings, a menu appears on the right of the page including the option About Chrome, which when clicked shows the current version of Google Chrome running and options to allow the user to download and install any available updates.