Google released security updates to address 14 vulnerabilities in the Chrome browser, including a zero-day issue that has been exploited in the wild.
The most severe of these flaws, tracked as CVE-2021-30544, is a critical use-after-free issue that impacts BFCache.
Google awarded $25,000 researchers Rong Jian and Guang Gong from 360 Alpha Lab for reporting this vulnerability.
Google released updates to fix six high-severity use-after-free flaws in Extensions, Autofill, Loader, Spell check, Accessibility, and V8, and a high-severity out-of-bounds write vulnerability in ANGLE.
“Google is aware that an exploit for CVE-2021-30551 exists in the wild.” reads the post published by Google.
Shane Huntley, director of Google’s Threat Analysis Group, revealed that a “commercial exploit company providing capability for limited nation-state Eastern Europe/Middle East targeting” has developed an exploit for the CVE-2021-30551.
It seems that the same commercial exploit company has also developed an exploit for a critical RCE, tracked as CVE-2021-33742, in the Windows MSHTML platform.
Since the beginning of 2021, Google addressed other zero-day vulnerabilities in Chrome:
(SecurityAffairs – hacking, Google Chrome)