Security News > 2023 > September > Video Encoding Library Leaves Chrome, Firefox and More Open to Zero-Day Attack
Google and Mozilla have patched a zero-day exploit in Chrome and Firefox, respectively.
The zero-day exploit could leave users open to a heap buffer overflow, through which attackers could inject malicious code.
If you use Chrome, update to 117.0.5938.132 when it becomes available; Google Chrome says it may take "Days/weeks" for all users to see the update.
The zero-day exploit is technically a heap buffer overflow in VP8 encoding in libvpx, which is a video code library developed by Google and the Alliance for Open Media.
"A commercial surveillance vendor" was actively using the exploit, researcher Maddie Stone of Google's Threat Analysis Group noted on X. There is not a lot more information available about the zero-day exploit at this time.
"Google is aware that an exploit for CVE-2023-5217 exists in the wild," the company wrote in the Chrome release update.
News URL
https://www.techrepublic.com/article/google-zero-day-firefox-others/
Related news
- Zero-Day Alert: Google Releases Chrome Patch for Exploit Used in Russian Espionage Attacks (source)
- New Syncjacking attack hijacks devices using Chrome extensions (source)
- Google fixes Android kernel zero-day exploited in attacks (source)
- 7-Zip MotW bypass exploited in zero-day attacks against Ukraine (source)
- Apple fixes zero-day exploited in 'extremely sophisticated' attacks (source)
- Apple fixes zero-day flaw exploited in “extremely sophisticated” attack (CVE-2025-24200) (source)
- PostgreSQL Vulnerability Exploited Alongside BeyondTrust Zero-Day in Targeted Attacks (source)
- Critical PostgreSQL bug tied to zero-day attack on US Treasury (source)
- Microsoft fixes Power Pages zero-day bug exploited in attacks (source)
- Firefox continues Manifest V2 support as Chrome disables MV2 ad-blockers (source)
Related Vulnerability
| DATE | CVE | VULNERABILITY TITLE | RISK |
|---|---|---|---|
| 2023-09-28 | CVE-2023-5217 | Out-of-bounds Write vulnerability in multiple products Heap buffer overflow in vp8 encoding in libvpx in Google Chrome prior to 117.0.5938.132 and libvpx 1.13.1 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. network low complexity webmproject microsoft mozilla fedoraproject debian apple google redhat CWE-787 | 8.8 |