Users are urged to update immediately

In a critical development for internet security, Google has issued an urgent update for its Chrome web browser, addressing a high-severity zero-day vulnerability, identified as CVE-2023-7024. This flaw, which has been exploited in the wild, poses a significant threat to users globally.

Discovered by Clément Lecigne and Vlad Stolyarov of Google’s Threat Analysis Group, CVE-2023-7024 is a heap-based buffer overflow vulnerability within the WebRTC framework. This bug can lead to severe consequences, such as program crashes or, more worryingly, the execution of arbitrary code by an attacker.

This vulnerability is particularly alarming due to the widespread use of the WebRTC framework, not only in Google Chrome but also in other major browsers like Mozilla Firefox, Apple Safari, and Microsoft Edge. This raises concerns about the potential broader impact beyond just Chrome and Chromium-based browsers.

This incident marks the eighth zero-day flaw that Google has patched in Chrome since the beginning of the year, indicating an increasing trend in software vulnerabilities. These include various types of security flaws, such as type confusion in V8 and integer overflow in Skia.

According to data compiled by Qualys, a staggering 26,447 vulnerabilities have been disclosed in 2023, exceeding the previous year’s count by over 1,500 CVEs. Among these, 115 flaws have been actively exploited by threat actors and ransomware groups.

To mitigate this threat, Google has released updates for Chrome: version 120.0.6099.129/130 for Windows and 120.0.6099.129 for macOS and Linux. Users are strongly advised to update their browsers to these versions immediately. Additionally, users of Chromium-based browsers like Microsoft Edge, Brave, Opera, and Vivaldi should also ensure they apply available updates.

Experts recommend enabling automatic updates in browsers to receive timely protections against such vulnerabilities. Furthermore, maintaining general cybersecurity hygiene, such as avoiding suspicious links and using secure networks, remains crucial.

The CVE-2023-7024 zero-day flaw in Google Chrome underscores the continuous threat posed by cyber vulnerabilities and the importance of prompt updates and cybersecurity awareness among users.

“The CVE-2023-7024 zero-day flaw in Google Chrome underscores the continuous threat posed by cyber vulnerabilities and the importance of prompt updates and cybersecurity awareness among users.”