6th Google Chrome Zero-day Vulnerability Under Active Exploitation

Google Chrome has released urgent security updates in its latest patch that remediate seven (7) vulnerabilities, one of them being an actively-exploited critical zero-day bug. The zero-day vulnerability, tracked as CVE-2023-6345, is an integer overflow weakness existing in Chrome’s Skia open-source 2D graphics library, an engine providing common APIs compatible with a wide variety of hardware and software. If successfully exploited, this flaw could allow threat actors that have compromised the renderer process to perform a sandbox escape via maliciously crafted files. The vulnerability was found by researchers from Google’s own Threat Analysis Group (TAG) who indicated that the bug could be exploited by state-sponsored threat actors to deliver spyware to unsuspecting high-profile victims like journalists and politicians. The technical details of the exploit are currently being withheld to allow as many Chrome users as possible to update their vulnerable browsers, but Google has acknowledged that that a proof-of-concept (PoC) exploit exists in-the-wild. CTIX analysts will continue to monitor the fallout of this zero-day and may release an update if new information becomes public.