Jump to content
  • Latest Chrome and Edge stable channel builds fix critical memory UAF security vulnerability


    Karlston

    • 1.1k views
    • 2 minutes
     Share


    • 1.1k views
    • 2 minutes

    Microsoft and Google have both released new Stable Channel Builds that patch a critical Chromium-based Use-After-Free (UAF) vulnerability which could allow attackers to execute arbitrary code upon successful exploitation. For Edge, it is version 94.0.992.31, while for Google Chrome, it is version 94.0.4606.61. The new builds are based on Chromium version 94.0.4606.54.

     

    The vulnerability has been assigned the ID "CVE-2021-37973" and the flaw was discovered by a Google Security engineer Clément Lecigne with assistance from Sergei Glazunov and Mark Brand, among others.

     

    Google states it found the UAF vulnerability in its Portals feature and according to CERT, "a remote attacker could exploit this vulnerability to execute arbitrary code or cause a denial of service condition on the system".

     

    Use-After-Free is a security flaw that occurs when a program or application fails to properly manage the memory pointer after a dynamic memory portion has been freed, which in turn can lead to code execution by an attacker.

     

    A pointer stores data related to a certain address of the memory that is being used by the application. But dynamic memory is constantly flushed and reallocated for use by different apps. However, if that pointer is not set to null once its corresponding memory space has been freed or unallocated, attackers can successfully exploit that pointer data to gain access to that same memory portion to now pass arbitrary malicious code. This is why the vulnerability is named Use-After-Free.

     

    It has been assured however that both Edge 94.0.992.31 and Chrome 94.0.4606.61 have patched this critical memory-based security flaw and it is probably recommended that users update their browsers to these versions.

     

    Latest Chrome and Edge stable channel builds fix critical memory UAF security vulnerability

    • Like 2

    User Feedback

    Recommended Comments

    There are no comments to display.



    Join the conversation

    You can post now and register later. If you have an account, sign in now to post with your account.
    Note: Your post will require moderator approval before it will be visible.

    Guest
    Add a comment...

    ×   Pasted as rich text.   Paste as plain text instead

      Only 75 emoji are allowed.

    ×   Your link has been automatically embedded.   Display as a link instead

    ×   Your previous content has been restored.   Clear editor

    ×   You cannot paste images directly. Upload or insert images from URL.


  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...