Google Chrome Zero-day 2022
5 min read
Zero-day vulnerabilities are hard to anticipate and can often be exploited for weeks or months until developers finally realize they exist. The latest zero-day security flaw was discovered in the rollout of Google Chrome’s latest edition. What dangers were users exposed to?
What is a zero-day vulnerability?
Zero-day vulnerabilities are flaws or loopholes in a system that were overlooked by developers before the software was rolled out. “Zero-day” refers to the number of days that developers have been aware of the security issue. Zero-day vulnerabilities will not have an immediate fix because developers first need to be made aware of the bug and then spend time patching it.
A zero-day exploit is code that hackers will utilize after news of the zero-day vulnerability spreads around the web. By exploiting the security flaw, hackers can install back doors into a system, further injecting malware or stealing sensitive data.
What happened with the latest Google Chrome zero-day vulnerability?
Unfortunately, Google Chrome was plagued with several zero-day vulnerabilities for one of its first updates of 2022. Chrome had similar issues in 2021, with one zero-day update requiring three emergency patches to fix the holes.
This time around, in February of 2022, Google announced via its blog that a high-level zero-day vulnerability was actively being exploited. Six other high-level threats were discovered and left every operating system with that version of Chrome vulnerable.
This event marks the 26th time in 2022 that Google Chrome was successfully attacked via a memory issue exploit. The majority of the flaws were UAF flaws, or Use-After-Free. UAF vulnerabilities involve improper dynamic memory allocation while a program is running. Google’s notes on the vulnerabilities were sparse, only revealing the software or program that was exploited by a UAF flaw:
- High threat level – CVE-2022-0603: Use after free in File Manager. Reported by on 2022-01-22
- High threat level – CVE-2022-0604: Heap buffer overflow in Tab Groups. Reported on 2021-11-24
- High threat level – CVE-2022-0605: Use after free in Webstore API. Reported on 2022-01-13
- High threat level – CVE-2022-0606: Use after free in ANGLE. Reported on 2022-01-17
- High threat level – CVE-2022-0607: Use after free in GPU. Reported on 2021-09-17
How do I update Google Chrome?
If you’re still resolute in using Google Chrome as your primary browser, you need to keep it updated at all times. Luckily, the process is incredibly simple.
- Open up your Chrome browser and tap on the three vertical dots in the top right corner.
- Hover over “Help,” where another drop down menu will appear. Now click on “About Google Chrome.”
- From this new window, you will see if your Google Chrome is currently running on the latest update. If it isn’t, the option to update the browser will be shown.
- You also have the option to set Chrome to auto update. Before closing the window, click on “Automatically update Chrome for all users.” This should save you the trouble of doing it all manually.
How do I avoid zero-day vulnerabilities?
Preventing your network from being the victim of a zero-day vulnerability seems to be a paradoxical task. How can you defend yourself from an attack that you know nothing about? While predicting the type of cyberattack is nigh impossible, you can help mitigate and control the damage from a zero-day exploit in several ways.
- Update your software. Every cybersecurity expert under the sun will tell you updates are important. Keep your cybersecurity software up to date with the latest editions and patches. When it comes to your protective software, it’s a wise choice to have them on auto-update.
- Control user access. Anyone with a good sense for cybersecurity would make sure that users can only access the parts of a system they need for their task or job. If a hacker were to exploit a vulnerability via a single user’s computer, the damage could be isolated to a single system and may struggle to access other parts of the network.
- Regularly back your data up. If you have measures in place that back up a network’s data on a regular basis, the damage from a zero-day exploit can be mitigated. Just roll the network back to just before the attack happened.
- Choose your browser carefully. If the primary browser you use has a seeming weakness for specific types of attacks and frequently is exploited by them, it might be time to look around and find out what the safest browser for your needs is. Unfortunately, even Chrome safe mode won’t help prevent these kind of attacks.
Ultimately, there’s not much you can do in the way of preventing zero-day vulnerabilities. However, staying on top of your cybersecurity will most certainly help reduce the damages should you be a victim of an exploit.
