Google fixes severe Chrome flaws

By

Advisory warns of multiple vulnerabilities.

Google has been forced to release new security fixes for multiple high severity vulnerabilities in its Chrome browser which could lead to an attacker taking over a victim's PC remotely.

The flaws, which were issued as part of the Chrome 2.0.172.43 update sent automatically to users, include two rated 'high severity' and one 'medium risk', according to a security advisory posted by Google engineering programme manager Jonathan Conradt.

The first, CVE-2009-2935, involves a flaw in the V8 JavaScript engine which could allow "specially-crafted JavaScript on a web page to read unauthorised memory, bypassing security checks".

"It is possible that this could lead to disclosing unauthorised data to an attacker, or allow an attacker to run arbitrary code," wrote Conradt. "An attacker might be able to run arbitrary code within the Google Chrome sandbox."

The other vulnerability, CVE-2009-2416, could lead to pages using XML causing a Google Chrome tab process to crash, said the firm.

"A malicious XML payload may be able to trigger a use-after-free condition. Other tabs are unaffected," read the advisory.

Google stressed, however, that Chrome's sandbox feature prevented the vulnerabilities from being rated 'critical'.

Google fixes severe Chrome flaws
Got a news tip for our journalists? Share it with us anonymously here.
Copyright ©v3.co.uk
Tags:

Most Read Articles

CBA using facial recognition logins to verify disputed payments

CBA using facial recognition logins to verify disputed payments

Top US diplomat impersonated with AI by unknown actor

Top US diplomat impersonated with AI by unknown actor

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

UK police arrest four over cyberattacks on M&S, Co-op and Harrods

Google Gemini for Workspace vulnerable to prompt injection attacks

Google Gemini for Workspace vulnerable to prompt injection attacks

Log In

  |  Forgot your password?