Chrome memory flaw is exploited, Google says, and an update fixes it
- Affected
- Chrome before
157.0.8103.50on Windows, Mac, Linux and Android, and the Extended Stable channel before156.0.8078.96. All versions and fixes
- Vendor
Google’s Nov 9 Chrome update fixes a use-after-free flaw in how the browser handles Extensible Markup Language (XML). Google says it is aware that an exploit for the flaw exists in the wild, and it rates the flaw high severity. The fix is in Chrome 157.0.8103.50 for Windows, Mac and Linux, and in the Extended Stable and Android releases.
In a use-after-free flaw, a program keeps using memory after it has freed it. Google’s release notes give only the flaw’s type, the component and the date it was reported, Nov 6, by someone Google lists as anonymous. Google may keep bug details private until most users have the fix, its notes say.
Google hasn’t said who used the exploit or against whom. Its notes list the flaw under a CVE ID, but the CVE record hadn’t been published by the morning of Nov 10. The same update fixes eight other flaws, including a second use-after-free flaw in XML handling, reported on Oct 12.
Edge is built on Chromium. In its Edge security release notes for Nov 9, Microsoft says it is aware of recent exploits in the wild and is working on a fix. The note doesn’t name a flaw. The latest Edge release Microsoft lists, 157.0.4341.42, came out on Nov 5, before Google’s fix.
- Vendor
What to do
4 steps
Affected and fixed versions
| Product | Affected | Fixed |
|---|---|---|
| Chrome for Windows and Mac | Earlier versions | 157.0.8103.50 or 157.0.8103.51 or later |
| Chrome for Linux | Earlier versions | 157.0.8103.50 or later |
| Chrome Extended Stable for Windows and Mac | Earlier versions | 156.0.8078.96 or later |
| Chrome for Android | Earlier versions | 157.0.8103.50 or later |
- Product
- Chrome for Windows and Mac
- Affected
- Earlier versions
- Fixed
157.0.8103.50or157.0.8103.51or later
- Product
- Chrome for Linux
- Affected
- Earlier versions
- Fixed
157.0.8103.50or later
- Product
- Chrome Extended Stable for Windows and Mac
- Affected
- Earlier versions
- Fixed
156.0.8078.96or later
- Product
- Chrome for Android
- Affected
- Earlier versions
- Fixed
157.0.8103.50or later
Timeline
- Nov 6An anonymous reporter tells Google about the flaw in Chrome’s XML handling.
- Nov 9Google ships Chrome
157.0.8103.50with the fix and says an exploit for the flaw exists in the wild. - Nov 9Microsoft says it’s aware of recent exploits in the wild and is working on a fix for Edge.
Sources
- Google release notes for Chrome 157 on desktopPrimary source chromereleases.googleblog.com
- Google release notes for Extended StablePrimary source chromereleases.googleblog.com
- Google release notes for Chrome 157 on AndroidPrimary source chromereleases.googleblog.com
- Microsoft release notes for Edge securityPrimary source learn.microsoft.com