From securityaffairs.co
Google has addressed two zero-day vulnerabilities, actively exploited in the wild, with the release of Chrome version 86.0.4240.198.
The IT giant has fixed a total of five Chrome zero-day vulnerabilities in only three weeks.
Both zero-day flaws, tracked as CVE-2020-16013 and CVE-2020-16017, were reported by anonymous sources. Google experts did not disclose the way the flaws have been exploited in the attacks, for example, it is not clear if they were chained by threat actors.
The other three zero-days patched by Google in the last weeks were:
- CVE-2020-15999 – The flaw is a memory corruption bug that resides in the FreeType font rendering library, which is included in standard Chrome releases.
- CVE-2020-16009 – is a Heap buffer overflow in Freetype in Google Chrome.
- CVE-2020-16010 – affects the browser’s user interface (UI) component in Chrome for Android.