Security News > 2020 > February > Google fixes another Chrome zero-day exploited in the wild

For the third time in a year, Google has fixed a Chrome zero-day that is being actively exploited by attackers in the wild.

No details have been shared about the attacks and about the flaw itself, apart from the short description that says it's a type confusion flaw in V8, the JavaScript engine used by the Chrome browser.

The fix was already in place a day later but, as the code is public, researchers from Exodus Intelligence managed to analyze it and develop proof-of-concept exploit code.

They released the exploit - which works only if Chrome's sandbox is disabled or can be bypassed via another vulnerability - and pointed out that it's a good thing Google has managed to reduce Chrome's "Patch gap" to two weeks.

The Chrome release fixing CVE-2020-6418 and two other high-risk flaws was released for Windows, Mac, and Linux and will roll out over the coming days/weeks.

News URL

http://feedproxy.google.com/~r/HelpNetSecurity/~3/YQ3U9Q_r97g/