Google rolled out fixes on Wednesday to address an actively exploited zero-day vulnerability in the Chrome browser.

Tracked as CVE-2023-5217, this high-severity vulnerability is a heap-based buffer overflow in the VP8 compression format within libvpx, a free software video codec library developed by Google and the Alliance for Open Media (AOMedia).

The exploitation of such buffer overflow flaws can lead to program crashes or the execution of arbitrary code, significantly impacting its availability and integrity.

Clément Lecigne from Google’s Threat Analysis Group (TAG) is credited with discovering and reporting the flaw on September 25, 2023. Fellow researcher Maddie Stone mentioned on X (formerly Twitter) that a commercial spyware vendor has exploited this vulnerability to target high-risk individuals.

The tech giant has not disclosed additional details, but they have acknowledged being “aware that an exploit for CVE-2023-5217 exists in the wild.”

The latest discovery marks the fifth zero-day vulnerability in Google Chrome for which patches have been released this year:

• CVE-2023-2033 (CVSS score: 8.8) – Type confusion in V8
• CVE-2023-2136 (CVSS score: 9.6) – Integer overflow in Skia
• CVE-2023-3079 (CVSS score: 8.8) – Type confusion in V8
• CVE-2023-4863 (CVSS score: 8.8) – Heap buffer overflow in WebP

Additionally, there are suspicions that the Israeli spyware maker Cytrox may have exploited a recently patched Chrome vulnerability (CVE-2023-4762, CVSS score: 8.8) as a zero-day to deliver Predator. However, little information is currently available about the in-the-wild attacks.

This development comes as Google assigned a new CVE identifier, CVE-2023-5129, to a critical flaw in the libwebp image library, originally tracked as CVE-2023-4863. This vulnerability has been actively exploited in the wild, given its broad attack surface.

To mitigate potential threats, users are strongly recommended to upgrade to Chrome version 117.0.5938.132 for Windows, macOS, and Linux. Furthermore, users of Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are advised to apply the fixes as soon as they become available.

On Thursday, Mozilla released updates for Firefox to address CVE-2023-5217. They noted that the ‘specific handling of an attacker-controlled VP8 media stream could lead to a heap buffer overflow in the content process.’ This issue has been resolved in the following versions: Firefox 118.0.1, Firefox ESR 115.3.1, Firefox Focus for Android 118.1, and Firefox for Android 118.1.

5. Privilege Elevation Attempt

The strength of systems lies in their weakest points. Ethical hackers often start by logging in as low-authority users. In this stage, the penetration tester focuses on exploiting vulnerabilities within the operating system or environment, aiming to attain administrator-level authority.

Once these privileges are secured, the objective is to extend control to additional network devices, eventually targeting roles such as Domain Administrator or Database Administrator.

6. Reporting and Presentation

After completing the penetration test and bug bounty steps, the penetration tester or bug hunter needs to present a comprehensive report to the organization. This report should detail the security vulnerabilities identified in the target system, the methods used for testing, and the exploitation techniques employed. Visual aids such as pictures, sample scripts, attack stages, and descriptions of vulnerability effects should be included to enhance understanding.

The final report should highlight the weaknesses and propose potential measures to close the security gaps. It’s vital to maintain the sensitivity and independence of penetration tests, keeping specific details undisclosed. Ethical hackers are bound by a duty of confidentiality and must never reveal any confidential information discovered during the assessment or mislead others, as such actions are strictly prohibited.

Why Is Penetration Test Important?

The primary objective of penetration testing is to evaluate the security of a system’s infrastructure from the viewpoint of a potential attacker and subsequently address vulnerabilities. It assesses an organization’s security posture, evaluates the relevance of security policies, tests personnel security awareness, and validates the effectiveness of cybersecurity implementations.

There is an increasing need for more penetration tests, particularly conducted by certified ethical penetration testers. These professionals play a critical role in assessing and enhancing the security of both corporate and personal application infrastructures.