Google releases patch for actively exploited vulnerability in Chrome

Google has released a patch for an actively exploited vulnerability in the Chrome browser. The vulnerability is in the Skia engine, which is used to display images and text. It’s the sixth zero day in Chrome that Google has patched this year.

The patch is in Chrome version 119.0.6045.199 and 119.0.6045.200 for Windows and 119.0.6045.199 for macOS and Linux. In addition to six other bug fixes, the zero day in the Skia engine has also been resolved. This vulnerability is referred to as CVE-2023-6345. Google says it is “aware of reports” that this vulnerability is already being exploited.

The bug enables an integer overflow in the Skia engine. Attackers could potentially cause crashes or, in the worst case, execute arbitrary code within the browser. The vulnerability was found by two researchers from Google’s Threat Analysis Group. The company is not sharing any further details. Google usually withholds concrete information about vulnerabilities until most users have installed the patch.

Google Chrome updates usually install automatically within a few days. Users can also install the update manually. This is possible by clicking ‘Help’ in the browser and then ‘About Google Chrome’ in the settings menu at the top right of the browser. Users can install the update there, after which the browser can be restarted.