Security News
Two researchers have earned $20,000 from Google for reporting a sandbox escape vulnerability affecting the Chrome web browser. The researchers who discovered the issue, Leecraso and Guang Gong of the 360 Alpha Lab at Chinese cybersecurity company Qihoo 360, told SecurityWeek that while the vulnerability affects Chrome on all platforms, they have only managed to trigger it on Android.
An obvious example is for the purposes of security filtering, where a network security device or cloud service deliberately redirects known bad domains, such as malware repositories, thus heading off potentially malicious traffic right at the DNS level. Simply put, a DNS lookup for a server name that doesn't exist at all, and therefore can't be resolved, is supposed to come back with a DNS error 3, known as NXDOMAIN, short for non-exsistent domain.
Chrome 85 was released in the stable version with 20 security fixes inside, including patches for 14 vulnerabilities disclosed by external researchers. Seven medium severity bugs reported by external researchers were patched in this Chrome release, including an inappropriate implementation in Content, four insufficient policy enforcements, and two incorrect security UI issues.
The Google Chrome web browser has a high-severity vulnerability that could be used to execute arbitrary code, researchers say. The flaw has been fixed in the Chrome 85 stable channel, set to be rolled out to users this week.
Google is working on improving the security of Chrome users by alerting them when filling out forms on secure pages that are delivered insecurely. Chrome versions prior to 86 mark mixed forms by removing the lock icon from the address bar.
Entering information into and submitting it through insecure online forms will come with very explicit warnings in the upcoming Chrome 86, Google has announced. "Before M86, mixed forms were only marked by removing the lock icon from the address bar. We saw that users found this experience unclear and it did not effectively communicate the risks associated with submitting data in insecure forms," Shweta Panditrao, a software engineer with the Chrome Security Team, explained.
Google announced on Wednesday that it's preparing to run an experiment in Chrome 86 as part of its fight against URL spoofing. Research conducted recently by Google and the University of Illinois at Urbana-Champaign showed that 60 percent of users were tricked when a URL path contained a misleading brand name.
Google this week announced that an update for Chrome 84 includes 15 security patches, including for a serious vulnerability for which the tech giant awarded a $10,000 bug bounty. This vulnerability is CVE-2020-6542, a high-severity use-after-free bug in ANGLE, the Chrome component responsible for translating OpenGL ES API calls to hardware-supported APIs available for the operating system.
Cybersecurity researchers on Monday disclosed details about a zero-day flaw in Chromium-based web browsers for Windows, Mac and Android that could have allowed attackers to entirely bypass Content Security Policy rules since Chrome 73. Tracked as CVE-2020-6519, the issue stems from a CSP bypass that results in arbitrary execution of malicious code on target websites.
The bug is found in Chrome, Opera and Edge, on Windows, Mac and Android - potentially affecting billions of web users, according to PerimeterX cybersecurity researcher Gal Weizman. CSP allows web admins to specify the domains that a browser should consider to be valid sources of executable scripts.