Google Removes 0 Day Vulnerability From Chrome Browser

Google has released an important security update for Chrome. The Google developers have eliminated five vulnerabilities, including a 0-day vulnerability.

In the new Chrome version 89.0.4389.90 for Windows, macOS and Linux, the manufacturer has closed five security holes, including a new 0-day hole. This is the second Chrome vulnerability to be used for attacks this month – and the third this year.

In the Chrome Release Blog, Prudhvikumar Bommana lists the three vulnerabilities that were discovered by external security researchers and reported to Google. All three are classified as high risk. This also includes the CVE-2021-21193 vulnerability, a use-after-free vulnerability (UAF) in the HTML renderer Blink, which was discovered by an unnamed person.

According to Prudhvikumar Bommana, Google has received reports that exploit code is in circulation for this vulnerability. This does not necessarily mean that the vulnerability is already being used for attacks, but it should be treated the same way. Google also classifies two other vulnerabilities as high risk: a UAF vulnerability in WebRTC (CVE-2021-21191) and a buffer overflow in tab groups (CVE-2021-21192).

Microsoft Also Removes 0 Day Vulnerability From Edge

manufacturers of other Chromium-based browsers are not ready yet. Brave after all, Microsoft Edge is already with the current Chromium generation 89. Vivaldi and Opera are still bobbing around with Chromium 88 – ten days after Google had filled a 0-day gap with the first stable Chrome 89 version. There is still a gap in Opera and Vivaldi – and now a second one.

[Update:] Microsoft has now released an update to Edge 89.0.774.54, which is based on Chromium 89.0.4389.90 and fixes the vulnerabilities mentioned above. [/ Update]. Chrome 90 will be released on 13 April.