Chrome-based browsers have vulnerability

Stefan Mileschin · 15th April 2021, 10:31

Proof-of-concept today exploit code published

An Indian security researcher has published proof-of-concept today exploit code for a recently discovered vulnerability impacting Google Chrome, Microsoft Edge, and other Chromium-based browsers like Opera and Brave.

The researcher, Rajvardhan Agarwal, said that the exploit code is for a Chromium bug used during the Pwn2Own hacking contest last week.

During the contest, security researchers Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow Security used a vulnerability to run malicious code inside Chrome and Edge, for which they received $100,000. Per contest rules, the bug information was handed over to the Chrome security team to be patched, and details never publicly disclosed.

Agarwal spotted the patches for this bug by looking at the source code commits to the V8 JavaScript engine, a component of the Chromium open-source browser project, which allowed him to recreate the Pwn2Own exploit, which he uploaded earlier today on GitHub, and shared on Twitter.

While Chromium developers patched the V8 bug last week, the patch has not yet been integrated into official releases of downstream Chromium-based browsers such as Chrome, Edge, and others, which are still vulnerable.

https://fudzilla.com/news/52678-chro...ave-vulnerably

15th April 2021, 10:31	#1
Stefan Mileschin [M] Reviewer Join Date: May 2010 Location: Romania Posts: 153,575	Chrome-based browsers have vulnerability Proof-of-concept today exploit code published An Indian security researcher has published proof-of-concept today exploit code for a recently discovered vulnerability impacting Google Chrome, Microsoft Edge, and other Chromium-based browsers like Opera and Brave. The researcher, Rajvardhan Agarwal, said that the exploit code is for a Chromium bug used during the Pwn2Own hacking contest last week. During the contest, security researchers Bruno Keith (@bkth_) & Niklas Baumstark (@_niklasb) of Dataflow Security used a vulnerability to run malicious code inside Chrome and Edge, for which they received $100,000. Per contest rules, the bug information was handed over to the Chrome security team to be patched, and details never publicly disclosed. Agarwal spotted the patches for this bug by looking at the source code commits to the V8 JavaScript engine, a component of the Chromium open-source browser project, which allowed him to recreate the Pwn2Own exploit, which he uploaded earlier today on GitHub, and shared on Twitter. While Chromium developers patched the V8 bug last week, the patch has not yet been integrated into official releases of downstream Chromium-based browsers such as Chrome, Edge, and others, which are still vulnerable. https://fudzilla.com/news/52678-chro...ave-vulnerably

Similar Threads
Thread	Thread Starter	Forum	Replies	Last Post
Chrome learns to mute sites based on your web history	Stefan Mileschin	WebNews	0	6th May 2018 06:50
Allo web chat now works in browsers other than Chrome	Stefan Mileschin	WebNews	0	6th October 2017 06:26
Why You Shouldn’t Use (Most) Alternative Browsers Based on Google Chrome	Stefan Mileschin	WebNews	0	25th March 2017 15:08
32-Bit vs. 64-Bit Browsers	jmke	WebNews	0	5th January 2016 16:03
Restore the ‘Classic’ Apps-Based New Tab Page in Google Chrome	Stefan Mileschin	WebNews	0	1st October 2013 08:09
Chrome beta for Android delivers a proxy-based speed boost	Stefan Mileschin	WebNews	0	6th March 2013 11:41
Skype disables password reset page to deal with email-based security 'vulnerability'	Stefan Mileschin	WebNews	0	15th November 2012 07:44
Chrome Is Most Secure of the Top Three Browsers	Stefan Mileschin	WebNews	0	12th December 2011 09:54
All web browsers suffer from terrible security	jmke	WebNews	0	3rd March 2011 15:31
AMD-based Roadmaps: Chrome everywhere in Via's AMD PCIe plans	jmke	WebNews	0	2nd October 2004 02:48