Google Chrome Vulnerability Patch Download

Posted : admin | On 25-04-2021

Google has quietly fixed a security flaw in Chrome for Android that was originally reported more than three years ago.

As reported by ZDNet, the vulnerability was found by bug-hunters at Nightwatch Cybersecurity in May 2015, but wasn't addressed until Google's security staff realized that it was, in fact, a threat.

Google has released Chrome version 57.0.2987.98 for Windows, Mac, and Linux. This version addresses multiple vulnerabilities that, if exploited, may allow an attacker to take control of an affected system. Vulnerabilities Keeping Internet users safe is more than just making sure Google's products are secure. RCE due to incomplete patch Patch for CVE-20 is incomplete: Jan Bee, Sebastian.

The flaw means that the mobile browser leaks information about the device it's running on, including the hardware model and firmware version – and therefore its security patch level. Chrome for desktop doesn't suffer the same issue.

Google Chrome Vulnerability Patch Download Free

Google Chrome Vulnerability Patch Download

Too much information

Browsers send various pieces of information to web servers as part of their normal operation, including details of the browser itself, other apps currently running, and the operating system. Unfortunately, Chrome for Android also sent the device name (such as C6606) and firmware build.

The device name might look random, but it correlates to a specific device model, and can be found easily online in readily available lists. For example, device name C6606 would be a Sony Xperia Z.

That's a security issue in itself, but the accompanying leaked firmware details are the biggest problem.

'For many devices, this can be used to identify not only the device, but also the carrier on which it is running and from that the country,' said Nightwatch Cybersecurity. 'Build numbers are easily obtainable from manufacturer and phone carrier websites such as this one.'

Google Vulnerability

Patch

The build number can also tell attackers the device's security patch level, thereby letting them know which attacks it could be vulnerable to.

Google released a partial fix with Chrome 70 in October 2018, but the browser still releases device names and two Android components (including WebView, which is the built-in browser used by apps like Facebook) still leak the firmware build number.

A Vietnamese security company has found a critical vulnerability in Google's new browser Chrome, but Google has already released patch for that problem and at least one more.

The vulnerability is one of several problems identified in the browser since it was released early last week. The bug is a buffer overflow that occurs if a user saves a Web page containing an overly long 'title' tag, according to Bach Koa Internetwork Security (Bkis), based at the Hanoi Institute of Technology.

The browser can encounter a problem trying to save a file with the name contained in the overly long title tag. An attacker could then have control of the PC and could execute other code on the machine, Bkis wrote on its blog. The problem can be exploited on PCs running Windows XP SP2 and Chrome version 0.2.149.27.

Google Chrome Vulnerability Patch Download

Chrome users are advised to upgrade to the latest version. To do that, go to the wrench icon in the upper right hand corner of the browser and down to 'About Google Chrome.' The browser will then check for an update. If there is one, Chrome will download it and ask to restart. The up-to-date version is 0.2.149.29.

Google chrome vulnerabilities

Although Google has been working on Chrome for two years, it still considers the browser a beta version. The company was using the browser internally among its employees for some time, but its surprise unveiling last week set the browser loose to the general public in more than two dozen languages.

Google Chrome Vulnerability

Last week, researcher Aviv Raff wrote that Chrome had a vulnerability due to its use of an outdated version of WebKit web browser engine. The vulnerability is know as the 'carpet bombing' flaw, which can cause Windows to download a potentially dangerous JAR (Java archive) and execute it without warning users. Google has also fixed that flaw, a company spokesman said Monday.

Google Chrome Vulnerability

The second problem identified shortly after Chrome's release could allow hackers to force Chrome to crash. That vulnerability, found by security researcher Rishi Narang, could be exploited by constructing a malicious link of a certain format, according to Narang's advisory.