Security Alert: Indian CERT-In Issues Warnings for Google Chrome and Chromebooks

The Indian Computer Emergency Response Team (CERT-In), operating under the Ministry of Electronics and Information Technology (MeitY), has issued security warnings for users of Google Chrome and Chromebooks in India.

Highlighting critical vulnerabilities, CERT-In urges users to update their browsers and Chromebook systems promptly to mitigate potential risks.

Google Chrome and Chromebooks Affected by Severe Vulnerabilities

CERT-In has identified and classified vulnerabilities in both Google Chrome and ChromeOS as high severity. The nature of these vulnerabilities allows hackers to execute malicious code, posing a significant threat to user data and system security. The affected software versions include:

• Google ChromeOS LTS channel version prior to 114.0.5735.339 (Platform version 15437.76.0)
• Google Chrome versions prior to 119.0.6045.123 for Linux and Mac
• Google Chrome versions prior to 119.0.6045.123/.124 for Windows

The vulnerabilities are associated with a use-after-free flaw in the Web Audio component of Google Chrome and ChromeOS.

Risks Posed by These Vulnerabilities

According to CERT-In's security notes, the vulnerabilities involve use-after-free flaws in profiles, inappropriate implementation in downloads, a heap buffer overflow in PDF, and issues in the Linux Kernel. Cybercriminals can exploit these weaknesses to force users into visiting specially crafted requests, enabling them to execute arbitrary code or cause denial-of-service (DoS) conditions. The vulnerabilities also allow attackers to bypass security measures on the affected systems.

Security Patches Rolled Out

Acknowledging the severity of these vulnerabilities, Google has promptly released security patches for both Google Chrome and ChromeOS. The patches address the identified vulnerabilities, reinforcing the importance of keeping software up to date to ensure robust cybersecurity.

CERT-In strongly advises users to update their browsers and Chromebook systems to the latest versions to safeguard against potential threats from malicious actors seeking to exploit these vulnerabilities.

Via