14 ms·

Chrome 0day is being exploited now for CVE-2022-1096; update immediately

265 points by gargarplex 5y ago

_8j50 5y ago
Is there a public exploit for this? Working on detecting browser exploitation myself.
- ineedasername 5y ago
  If you mean in-the-wild, then yes: https://securityboulevard.com/2022/03/google-chrome-cve-2022-1096-emergency-patch/ https://securityboulevard.com/2022/03/google-chrome-cve-2022...
- throwaway684936 5y ago
  I believe more details are usually published after most people are given a chance to update.
- baby 5y ago
  Let's give people a chance to update before spreading these please
buro9 5y ago
Type confusion in V8... May well impact Cloudflare workers too.
- dknecht 5y ago
  We have already tested and global rollout started earlier today.
- stjohnswarts 5y ago
  Yeah wondering if this also a 0 day for node.js and electron apps...
  - kentonv 5y ago
    This is a 0 day for anything that uses V8 to execute possibly-malicious JavaScript. Node.js and Electron aren't designed to do that in the first place, so this doesn't really affect them.
    - ComradePhil 5y ago
      Unless some protestware decides to delete all your data and replace everything with "icri4ukraine".
      - kentonv 5y ago
        That's the thing... It can already do that without a V8 vulnerability.
_Nat_ 5y ago
> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days.
- kerng 5y ago
  Microsoft has added some mitigtions to Edge a few months ago as defense in depth - wondering now if this is actually exploitable on Edge or if their mitigations prevent it? Any Microsoft/Edge security people on here? Update: found the original blog from Microsoft, they call it Super Duper Secure Mode: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
- Ourgon 5y ago
  > I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of Javascript. Imagine your current browser, only 100 times slower and 10 times more memory-hungry. Nope, the solution lies in getting rid of most of the Javascript on most pages. uBlock and uMatrix can help a bit but the real solution lies with web developers. If and when that goal is achieved it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines.
  - bastawhiz 5y ago
    > it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines. I don't plan on my bank trying to 0day my browser. If anything, I trust them not to do anything malicious more than the sites that actually need to go fast.
baq 5y ago
Just what the doctor ordered in the middle of a war which is also waged in the information space. Hopefully the fact that it’s in v8 will take the exploit a bit longer than usual to proliferate.
- draw_down 5y ago
mdb31 5y ago
Chromium-based versions of Microsoft Edge are also vulnerable: updating to 99.0.1150.55 fixes this CVE
paulpauper 5y ago
this just goes to show that updates are always 2 or so steps behind. It's a near certainty that governments, top criminal organizations have a trove of exploits for all major programs, and new ones created after old ones get patched.
suigetsusake 5y ago
It looks like this impacts all chromium-based browsers [0] which might not be obvious (was not for me anyway) [0] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-1096 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...
octoberfranklin 5y ago
When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem. When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.
- bawolff 5y ago
  There is no indication yet that this is due to complex web standards. It could be, but we literally dont know what the bug is yet.
  - hdjjhhvvhga 5y ago
    But we do know that it is Javascript-related, so please correct me if I'm wrong but disabling JS for all websites except the ones you really, really trust and need should offer long-term general protection against such 0-days in most cases.
    - paxys 5y ago
      There are lots of 0day exploits outside of the JavaScript engine. Going down this path, it would be safest to not use the web at all, or really just not own a computer.
      - hdjjhhvvhga 5y ago
        No, I think it's reductio ad absurdum; what I mean is reasonable means of reducing risks for people who don't use that much web apps and consume mostly text such as news etc.
      - stjohnswarts 5y ago
        That does close the window of attack to a much smaller area so yeah that improves your security statistically.
      - TheDong 5y ago
        My doctor told me I should stop smoking. There are a lot of ways to die outside of lung cancer though. Going down this path, it would be safest to not drink alcohol, not drive a car, or really just not live life at all. My point here is that there are some things that have outsized impacts and can be avoided in isolation. Smoking is like that for health. Javascript, ActiveX, java web applets, flash, any other way of executing arbitrary turing-complete remote code on my local machine directly, those are all vastly more likely to lead to CVEs than HTML parsers, image parsers, and other functionalities of browsers. It's perfectly possible to identity and eliminate larger attack surfaces without slippery-sloping yourself into not being able to take smaller risks.
amelius 5y ago
Is Electron at risk too?
- scambier 5y ago
  If your Electron app executes third party, remote code. But if it does, you should definitely not use it.
  - gruez 5y ago
    >If your Electron app executes third party, remote code. There's a high chance that it does because of embedded content/ads/iframes/in-app browsers.
    - mr_toad 5y ago
      Which electron apps have embedded ads running third party JavaScript? That’s a huge security risk.
    - kentonv 5y ago
      Are in-app browsers in Electron even secure in the first place? Does it use Chrome-style sandboxing with multiple processes, etc.? Do bugs in the Electron engine get patched in a timely fashion? Genuinely asking here. I've never written an Electron app personally so I don't know how this stuff is done exactly, but the idea of in-app browsers in Electron apps sounds terrifying to me, security-wise.
      - mwcampbell 5y ago
        Electron has been moving toward security by default in renderer processes, but Chromium sandboxing isn't yet enabled by default in these processes. More here: https://www.electronjs.org/docs/latest/tutorial/sandbox https://www.electronjs.org/docs/latest/tutorial/sandbox
- neoneye2 5y ago
  Visual Studio Code is built with Electron. VSCode has lots of extensions available. Can a VSCode extension exploit this 0day?
tommiegannert 5y ago
Looks like 99.0.4844.84 is the release we want. https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html https://chromereleases.googleblog.com/2022/03/stable-channel...
- metadat 5y ago
  It's definitely not yet out for Android. On my device the version is stuck at: 99.0.4844.73
  - lern_too_spel 5y ago
    I have 99.0.4844.88, updated yesterday. The release notes for Android don't mention the CVE. https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html https://chromereleases.googleblog.com/2022/03/stable-channel...
    - metadat 5y ago
      I just checked the play store and there was indeed a pending update for chrome. Now at .88. Until the next C++VE, cheers!
- techolic 5y ago
  I just upgraded to this and noticed the Reading List has changed design again! They must have gone back and forth thousands of times on this so hopefully this is the final version.
- rikroots 5y ago
  Release 99.0.4844.84 has borked my JS canvas library. Currently working on a fix - it was my misunderstanding of the purpose of the CanvasAPI willReadFrequently flag that left the library open to a severe speed degradation. In my defence the documentation implies that the willReadFrequently flag is only a hint to the browser, to take a different approach when performing getImageData() operations[1]. However setting the flag to true also impacts drawImage() functionality[2]. I tried reporting the issue as a bug last night - at the very least the issue needs to be documented - but the form for reporting issues kept collapsing on me so I gave up. [1] - https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement/getContext https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasE... [2] - minimum demo of issue - https://codepen.io/kaliedarik/pen/bGaqMVj https://codepen.io/kaliedarik/pen/bGaqMVj
gruez 5y ago
Is there a site/service/mailing list that provides notifications for critical/RCE/in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.
- cors-fls 5y ago
  Yes ! Computer Emergency Response Teams (CERT)[1] exist in most countries and publish security advisories as newsletters or RSS. e.g. CERT-EU security advisories [2] But there are so many softwares and exploits that the signal to noise ratio is low if you are not in charge of a big IT infra. [1] https://en.m.wikipedia.org/wiki/Computer_emergency_response_team https://en.m.wikipedia.org/wiki/Computer_emergency_response_... [2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBulletins_.html https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul...
  - gruez 5y ago
    >[2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul... I took a look and my first impressions are not good. 1. like you mentioned, the signal to noise ratio is pretty bad. eg. "OpenSSL/LibreSSL Vulnerability (CERT-EU Security Advisory 2022-017)" which is a DoS exploit that consumers would likely not care about. There's also no vendor/product filter, so I get notifications about "H2 Database Console" that I don't care about. 2. It's slow/out of date. eg. "Multiple Vulnerabilities in VMware (CERT-EU Security Advisory 2022-013)" was published on February 17, 2022, but the patch was published January 15th, a month earlier.
    - CiPHPerCoder 5y ago
      Yes, it's a firehose. I'm sure you can find a security vendor willing to offer a curated list somewhere.
- newman555 5y ago
  funny enough, was asking my self the same question yesterday after 5-minute googling didn’t get me anywhere. I see a recommendation mentioned below, but as I also saw, hard to find something where you can control signal to noise ratio
janci 5y ago
Is Chrome for android affected? And V8 in nodejs?
johndfsgdgdfg 5y ago
- ptk 5y ago
  I don’t know if you’re joking or not, and I say this as someone who uses Edge as their primary browser, but Edge does not improve the situation you describe. Edge is just a flavor of chromium at this point and absolutely gives Chrome a run for its money in the tracking and telemetry department.
- hungryforcodes 5y ago
  Windows 10 is definitely spyware. So migrating to Edge is hardly a solution. Chromium on the other hand...
- aceBacker 5y ago
  Heh, my corp locks down the edge updates and bundles them with the OS updates. Edge is going to be vulnerable to this one for months maybe a year longer that chrome.
  - mr_toad 5y ago
    Where I work they lock down Chrome updates as well.
fn-mote 5y ago
I use snap for some applications in spite of the trouble it has caused me. I was super-happy to find out that it had upgraded me to a not-vulnerable verson of chromium before I even knew to look. For all of the (deserved) hate snap gets, there are some shining up sides.
- the_common_man 5y ago
  I use apt and it didn't update to this vulnerable version in the first place, so there's that
  - nieve 5y ago
    Do we know for sure the vulnerability was only in that version?
ruuda 5y ago
Type confusion in V8 ... Fortunately I turned off javascript by default since Meltdown/Spectre.
- dijit 5y ago
  I did the same. But the web is basically unusable for me now and devs seem unsympathetic.
TT-392 5y ago
Anyone know if qutebrowser is affected?
- dijit 5y ago
  Yes
- creata 5y ago
  Why wouldn't it be? It uses Chromium (via QtWebEngine) by default.
  - stjohnswarts 5y ago
    because qtwebengine isn't updated nearly as often and this appear to be a recent bug not a long running one.
    - creata 5y ago
      Thanks, I didn't think about that.
      - stjohnswarts 5y ago
        I'm not saying it -isn't- in there, just that it's not 100% chance it's there. I don't think the exact "failure" has been cited yet. Would be good to check qute-browser webpage or qtwebengine page rather than a random HN asshole like me :D
        The-Compiler 4y ago
        See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebrowser_affected_by_cve20221096/ https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
- The-Compiler 4y ago
  See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebrowser_affected_by_cve20221096/ https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
ainar-g 5y ago
Looks like these are the two commits, based on the issue number: https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562ad1504f4bffdc https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562a... https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730c9fbba690fb7 https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730... Although there could be others.
- kerneloops 5y ago
- emerged 5y ago
  Interesting, I’ve never seen the “maybe_db” style of variable naming. Makes sense but looks weird.
- menomatter 4y ago
  From those commits, would you say this is RCE vulnerability taking advantage of memory/stack callbacks? Does this mean an attacker may exploit this vulnerability to compromise an entire system?
nathants 5y ago
securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3]. bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. bonus points if the filtering is at executable level granularity instead of system level. 1. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html 2. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch 3. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch
- figglestar 5y ago
  > monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. > bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. Is it possible to combine these two with open/tinysnitch somehow? It'd be nice to easily build a whitelist but with the way Windows works I couldn't trust any firewall that was running on Windows itself.
  - nathants 5y ago
    filtering upstream is easy, just send all traffic to a linux wireguard server and run a snitch there. getting the gui prompt is a bit tricker. for maximum trust, that gui should probably be on another device than the original machine. ie a push notification to your phone.
eezurr 5y ago
Anyone know if this affects Vivaldi? I assume it does since it's chromium based, but there isn't an update available.
- djokkataja 5y ago
  There's an update for the desktop browser: https://vivaldi.com/blog/desktop/minor-update-five-5-1/ https://vivaldi.com/blog/desktop/minor-update-five-5-1/
bArray 5y ago
Just added a bug for the Ubuntu Chromium dev PPA to update their packages: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1966572 https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+...
sysOpOpPERAND 5y ago
why is chrome having so many updates within the past few months? is it because of coverage? (more users?). i use chrome off and on between that and firefox depending on the site and i am surprised how often i've been reading about issues with chrome. should i switch browsers all together?
- hulitu 5y ago
  Every browser has updates every couple of weeks (without bringing nothing new). Quality of SW development has plumeted.
- eternityforest 5y ago
  Basically everyone seems to be getting hacked. It's like all the hackers in the world snorted something and have been hacking nonstop all month.
whatev1942 5y ago
What about CloudFlare ? Does this bring to question their decision to use V8 ?
t3odump 5y ago
I would like to analyze the issue of browser security without controversy. The mitigations that Edge puts into practice (I'm talking about "Super Duper Secure" and "Enhanced Security") can prevent the operation of exploits in the V8 engine like this 0-day? Is this platform dependent or the mitigation in progress works well? I mean for example some feature on mac and Linux is available out of the box asACG feature. This analysis is very interesting because I have only read analisys related to privacy and not about security and integrity. (I mean compare between Chorme, Edge, Brave, etc ...)

265 points by gargarplex 5y ago

_8j50 5y ago

Is there a public exploit for this? Working on detecting browser exploitation myself.

ineedasername 5y ago
If you mean in-the-wild, then yes: https://securityboulevard.com/2022/03/google-chrome-cve-2022-1096-emergency-patch/ https://securityboulevard.com/2022/03/google-chrome-cve-2022...
throwaway684936 5y ago
I believe more details are usually published after most people are given a chance to update.
baby 5y ago
Let's give people a chance to update before spreading these please

buro9 5y ago

Type confusion in V8... May well impact Cloudflare workers too.

dknecht 5y ago
We have already tested and global rollout started earlier today.
stjohnswarts 5y ago
Yeah wondering if this also a 0 day for node.js and electron apps...
- kentonv 5y ago
  This is a 0 day for anything that uses V8 to execute possibly-malicious JavaScript. Node.js and Electron aren't designed to do that in the first place, so this doesn't really affect them.
  - ComradePhil 5y ago
    Unless some protestware decides to delete all your data and replace everything with "icri4ukraine".
    - kentonv 5y ago
      That's the thing... It can already do that without a V8 vulnerability.

_Nat_ 5y ago

> Not much is known, at least publicly, at this stage about CVE-2022-1096 other than it is a "Type Confusion in V8." This refers to the JavaScript engine employed by Chrome. Is there a safer JavaScript engine folks can use without having to worry about this sorta thing? Even if it's slower, less compatible, more resource-intensive, etc.? I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days.

kerng 5y ago
Microsoft has added some mitigtions to Edge a few months ago as defense in depth - wondering now if this is actually exploitable on Edge or if their mitigations prevent it? Any Microsoft/Edge security people on here? Update: found the original blog from Microsoft, they call it Super Duper Secure Mode: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Secure-Mode/ https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec...
Ourgon 5y ago
> I feel like, in most cases, I could make due with JavaScript being 10x or even 100x slower, taking up 10x the RAM, lacking some uncommon features, and so forth -- if it meant being able to enable it without needing to worry about new zero-days. Not on the "modern web" you wouldn't, even the current speedy versions of V8 and ${whatever}monkey now used by Firefox the thing often is brought to a crawl by the deluge of Javascript. Imagine your current browser, only 100 times slower and 10 times more memory-hungry. Nope, the solution lies in getting rid of most of the Javascript on most pages. uBlock and uMatrix can help a bit but the real solution lies with web developers. If and when that goal is achieved it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines.
- bastawhiz 5y ago
  > it would be possible to browse the web using a slow-but-'safe' browser. Some pages (e.g. SPAs) really depend on all that Javascript and as such won't be useable withour 'modern' JS engines but there is no reason for e.g. your bank or payment processor's pages to depend on near-native speed Javascript engines. I don't plan on my bank trying to 0day my browser. If anything, I trust them not to do anything malicious more than the sites that actually need to go fast.

baq 5y ago

Just what the doctor ordered in the middle of a war which is also waged in the information space. Hopefully the fact that it’s in v8 will take the exploit a bit longer than usual to proliferate.

draw_down 5y ago

mdb31 5y ago

Chromium-based versions of Microsoft Edge are also vulnerable: updating to 99.0.1150.55 fixes this CVE

paulpauper 5y ago

this just goes to show that updates are always 2 or so steps behind. It's a near certainty that governments, top criminal organizations have a trove of exploits for all major programs, and new ones created after old ones get patched.

suigetsusake 5y ago

It looks like this impacts all chromium-based browsers [0] which might not be obvious (was not for me anyway) [0] https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-1096 https://msrc.microsoft.com/update-guide/vulnerability/CVE-20...

octoberfranklin 5y ago

When the web "standards" are so insanely complicated that even Google can't implement them securely, it's time to admit that we have a problem. When there is only one other complete implementation of these "standards" (with miniscule market share), it's time to panic.

bawolff 5y ago
There is no indication yet that this is due to complex web standards. It could be, but we literally dont know what the bug is yet.
- hdjjhhvvhga 5y ago
  But we do know that it is Javascript-related, so please correct me if I'm wrong but disabling JS for all websites except the ones you really, really trust and need should offer long-term general protection against such 0-days in most cases.
  - paxys 5y ago
    There are lots of 0day exploits outside of the JavaScript engine. Going down this path, it would be safest to not use the web at all, or really just not own a computer.
    - hdjjhhvvhga 5y ago
      No, I think it's reductio ad absurdum; what I mean is reasonable means of reducing risks for people who don't use that much web apps and consume mostly text such as news etc.
    - stjohnswarts 5y ago
      That does close the window of attack to a much smaller area so yeah that improves your security statistically.
    - TheDong 5y ago
      My doctor told me I should stop smoking. There are a lot of ways to die outside of lung cancer though. Going down this path, it would be safest to not drink alcohol, not drive a car, or really just not live life at all. My point here is that there are some things that have outsized impacts and can be avoided in isolation. Smoking is like that for health. Javascript, ActiveX, java web applets, flash, any other way of executing arbitrary turing-complete remote code on my local machine directly, those are all vastly more likely to lead to CVEs than HTML parsers, image parsers, and other functionalities of browsers. It's perfectly possible to identity and eliminate larger attack surfaces without slippery-sloping yourself into not being able to take smaller risks.

amelius 5y ago

Is Electron at risk too?

scambier 5y ago
If your Electron app executes third party, remote code. But if it does, you should definitely not use it.
- gruez 5y ago
  >If your Electron app executes third party, remote code. There's a high chance that it does because of embedded content/ads/iframes/in-app browsers.
  - mr_toad 5y ago
    Which electron apps have embedded ads running third party JavaScript? That’s a huge security risk.
  - kentonv 5y ago
    Are in-app browsers in Electron even secure in the first place? Does it use Chrome-style sandboxing with multiple processes, etc.? Do bugs in the Electron engine get patched in a timely fashion? Genuinely asking here. I've never written an Electron app personally so I don't know how this stuff is done exactly, but the idea of in-app browsers in Electron apps sounds terrifying to me, security-wise.
    - mwcampbell 5y ago
      Electron has been moving toward security by default in renderer processes, but Chromium sandboxing isn't yet enabled by default in these processes. More here: https://www.electronjs.org/docs/latest/tutorial/sandbox https://www.electronjs.org/docs/latest/tutorial/sandbox
neoneye2 5y ago
Visual Studio Code is built with Electron. VSCode has lots of extensions available. Can a VSCode extension exploit this 0day?

tommiegannert 5y ago

Looks like 99.0.4844.84 is the release we want. https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html https://chromereleases.googleblog.com/2022/03/stable-channel...

metadat 5y ago
It's definitely not yet out for Android. On my device the version is stuck at: 99.0.4844.73
- lern_too_spel 5y ago
  I have 99.0.4844.88, updated yesterday. The release notes for Android don't mention the CVE. https://chromereleases.googleblog.com/2022/03/stable-channel-update-for-desktop_25.html https://chromereleases.googleblog.com/2022/03/stable-channel...
  - metadat 5y ago
    I just checked the play store and there was indeed a pending update for chrome. Now at .88. Until the next C++VE, cheers!
techolic 5y ago
I just upgraded to this and noticed the Reading List has changed design again! They must have gone back and forth thousands of times on this so hopefully this is the final version.
rikroots 5y ago
Release 99.0.4844.84 has borked my JS canvas library. Currently working on a fix - it was my misunderstanding of the purpose of the CanvasAPI willReadFrequently flag that left the library open to a severe speed degradation. In my defence the documentation implies that the willReadFrequently flag is only a hint to the browser, to take a different approach when performing getImageData() operations[1]. However setting the flag to true also impacts drawImage() functionality[2]. I tried reporting the issue as a bug last night - at the very least the issue needs to be documented - but the form for reporting issues kept collapsing on me so I gave up. [1] - https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasElement/getContext https://developer.mozilla.org/en-US/docs/Web/API/HTMLCanvasE... [2] - minimum demo of issue - https://codepen.io/kaliedarik/pen/bGaqMVj https://codepen.io/kaliedarik/pen/bGaqMVj

gruez 5y ago

Is there a site/service/mailing list that provides notifications for critical/RCE/in-the-wild exploit patches? Keeping every piece of software you run up-to-date takes a lot of work, and something like that would help with knowing what to prioritize.

cors-fls 5y ago
Yes ! Computer Emergency Response Teams (CERT)[1] exist in most countries and publish security advisories as newsletters or RSS. e.g. CERT-EU security advisories [2] But there are so many softwares and exploits that the signal to noise ratio is low if you are not in charge of a big IT infra. [1] https://en.m.wikipedia.org/wiki/Computer_emergency_response_team https://en.m.wikipedia.org/wiki/Computer_emergency_response_... [2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBulletins_.html https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul...
- gruez 5y ago
  >[2] https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul https://cert.europa.eu/cert/newsletter/en/latest_SecurityBul... I took a look and my first impressions are not good. 1. like you mentioned, the signal to noise ratio is pretty bad. eg. "OpenSSL/LibreSSL Vulnerability (CERT-EU Security Advisory 2022-017)" which is a DoS exploit that consumers would likely not care about. There's also no vendor/product filter, so I get notifications about "H2 Database Console" that I don't care about. 2. It's slow/out of date. eg. "Multiple Vulnerabilities in VMware (CERT-EU Security Advisory 2022-013)" was published on February 17, 2022, but the patch was published January 15th, a month earlier.
  - CiPHPerCoder 5y ago
    Yes, it's a firehose. I'm sure you can find a security vendor willing to offer a curated list somewhere.
newman555 5y ago
funny enough, was asking my self the same question yesterday after 5-minute googling didn’t get me anywhere. I see a recommendation mentioned below, but as I also saw, hard to find something where you can control signal to noise ratio

janci 5y ago

Is Chrome for android affected? And V8 in nodejs?

johndfsgdgdfg 5y ago

ptk 5y ago
I don’t know if you’re joking or not, and I say this as someone who uses Edge as their primary browser, but Edge does not improve the situation you describe. Edge is just a flavor of chromium at this point and absolutely gives Chrome a run for its money in the tracking and telemetry department.
hungryforcodes 5y ago
Windows 10 is definitely spyware. So migrating to Edge is hardly a solution. Chromium on the other hand...
aceBacker 5y ago
Heh, my corp locks down the edge updates and bundles them with the OS updates. Edge is going to be vulnerable to this one for months maybe a year longer that chrome.
- mr_toad 5y ago
  Where I work they lock down Chrome updates as well.

fn-mote 5y ago

I use snap for some applications in spite of the trouble it has caused me. I was super-happy to find out that it had upgraded me to a not-vulnerable verson of chromium before I even knew to look. For all of the (deserved) hate snap gets, there are some shining up sides.

the_common_man 5y ago
I use apt and it didn't update to this vulnerable version in the first place, so there's that
- nieve 5y ago
  Do we know for sure the vulnerability was only in that version?

ruuda 5y ago

Type confusion in V8 ... Fortunately I turned off javascript by default since Meltdown/Spectre.

dijit 5y ago
I did the same. But the web is basically unusable for me now and devs seem unsympathetic.

TT-392 5y ago

Anyone know if qutebrowser is affected?

dijit 5y ago
Yes
creata 5y ago
Why wouldn't it be? It uses Chromium (via QtWebEngine) by default.
- stjohnswarts 5y ago
  because qtwebengine isn't updated nearly as often and this appear to be a recent bug not a long running one.
  - creata 5y ago
    Thanks, I didn't think about that.
    - stjohnswarts 5y ago
      I'm not saying it -isn't- in there, just that it's not 100% chance it's there. I don't think the exact "failure" has been cited yet. Would be good to check qute-browser webpage or qtwebengine page rather than a random HN asshole like me :D
      - The-Compiler 4y ago
        See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebrowser_affected_by_cve20221096/ https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.
The-Compiler 4y ago
See https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebrowser_affected_by_cve20221096/ https://www.reddit.com/r/qutebrowser/comments/tpuqj5/qutebro... - it seems to be, unfortunately.

ainar-g 5y ago

Looks like these are the two commits, based on the issue number: https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562ad1504f4bffdc https://github.com/v8/v8/commit/0981e91a4f8692af337e2588562a... https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730c9fbba690fb7 https://github.com/v8/v8/commit/a2cae2180a7a6d64ccdede44d730... Although there could be others.

kerneloops 5y ago
emerged 5y ago
Interesting, I’ve never seen the “maybe_db” style of variable naming. Makes sense but looks weird.
menomatter 4y ago
From those commits, would you say this is RCE vulnerability taking advantage of memory/stack callbacks? Does this mean an attacker may exploit this vulnerability to compromise an entire system?

nathants 5y ago

securing a machine that is updated regularly and runs untrusted code is not realistic, monitoring network exfil is. an exploit that cannot communicate is likely benign and easy to detect in the attempt. monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. macos has littlesnitch[1], linux has opensnitch[2], or roll your own on libnetfilterqueue[3]. bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. bonus points if the filtering is at executable level granularity instead of system level. 1. https://www.obdev.at/products/littlesnitch/index.html https://www.obdev.at/products/littlesnitch/index.html 2. https://github.com/evilsocket/opensnitch https://github.com/evilsocket/opensnitch 3. https://github.com/nathants/tinysnitch https://github.com/nathants/tinysnitch

figglestar 5y ago
> monitor all outbound network connections with a gui prompt that defaults to deny. whitelist trusted domains/ip for a better experience and a bit less security. > bonus points if the filtering happens upstream at a router or wireguard host so a compromised machine cannot easily disable filtering. Is it possible to combine these two with open/tinysnitch somehow? It'd be nice to easily build a whitelist but with the way Windows works I couldn't trust any firewall that was running on Windows itself.
- nathants 5y ago
  filtering upstream is easy, just send all traffic to a linux wireguard server and run a snitch there. getting the gui prompt is a bit tricker. for maximum trust, that gui should probably be on another device than the original machine. ie a push notification to your phone.

eezurr 5y ago

Anyone know if this affects Vivaldi? I assume it does since it's chromium based, but there isn't an update available.

djokkataja 5y ago
There's an update for the desktop browser: https://vivaldi.com/blog/desktop/minor-update-five-5-1/ https://vivaldi.com/blog/desktop/minor-update-five-5-1/

bArray 5y ago

Just added a bug for the Ubuntu Chromium dev PPA to update their packages: https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+bug/1966572 https://bugs.launchpad.net/ubuntu/+source/chromium-browser/+...

sysOpOpPERAND 5y ago

why is chrome having so many updates within the past few months? is it because of coverage? (more users?). i use chrome off and on between that and firefox depending on the site and i am surprised how often i've been reading about issues with chrome. should i switch browsers all together?

hulitu 5y ago
Every browser has updates every couple of weeks (without bringing nothing new). Quality of SW development has plumeted.
eternityforest 5y ago
Basically everyone seems to be getting hacked. It's like all the hackers in the world snorted something and have been hacking nonstop all month.

whatev1942 5y ago

What about CloudFlare ? Does this bring to question their decision to use V8 ?

t3odump 5y ago

I would like to analyze the issue of browser security without controversy. The mitigations that Edge puts into practice (I'm talking about "Super Duper Secure" and "Enhanced Security") can prevent the operation of exploits in the V8 engine like this 0-day? Is this platform dependent or the mitigation in progress works well? I mean for example some feature on mac and Linux is available out of the box asACG feature. This analysis is very interesting because I have only read analisys related to privacy and not about security and integrity. (I mean compare between Chorme, Edge, Brave, etc ...)