Google has been forced to release new security fixes for multiple high severity vulnerabilities in its Chrome browser which could lead to an attacker taking over a victim's PC remotely.The flaws, which were issued as part of the Chrome 2.0.172.43 update sent automatically to users, include two rated 'high severity' and one 'medium risk', according to a security advisory posted by Google engineering programme manager Jonathan Conradt. The first, CVE-2009-2935, involves a flaw in the V8 JavaScript engine which could allow "specially-crafted JavaScript on a web page to read unauthorised memory, bypassing security checks"."It is possible that this could lead to disclosing unauthorised data to an attacker, or allow an attacker to run arbitrary code," wrote Conradt. "An attacker might be able to run arbitrary code within the Google Chrome sandbox." The other vulnerability, CVE-2009-2416, could lead to pages using XML causing a Google Chrome tab process to crash, said the firm."A malicious XML payload may be able to trigger a use-after-free condition. Other tabs are unaffected," read the advisory.Google stressed, however, that Chrome's sandbox feature prevented the vulnerabilities from being rated 'critical'.
Copyright ©v3.co.uk
A confirmation email has been sent to your email address - SUPPLIED GOES EMAIL HERE. Please click on the link in the email to verify your email address. You need to verify your email before you can start posting.
If you do not receive your confirmation email within the next few minutes, it may be because the email has been captured by a junk mail filter. Please ensure you add the domain @itnews.com.au to your white-listed senders.