The second zero-day, CVE-2021-37976, involved an "information leak in core." We're not quite sure what that refers to as "core" can mean a dozen different things.
That means another application, potentially a malicious one, could seize space on your computer's memory chips immediately after V8 is done using it, getting a toehold in your system processes before the OS has a chance to reallocate that chunk of memory.ĭiscovery of the flaw was attributed to an anonymous researcher. The first zero-day flaw, catalogued as CVE-2021-37975, involves a "use after free" bug in V8, Chrome's JavaScript parser. As usual, the Chrome team isn't saying who is exploiting these vulnerabilities against whom, only that Google is "aware" that exploits for the two zero-day flaws "exist in the wild." (The adjective refers to the fact that defenders have zero days to prepare before the exploits are used - in other words, the bad guys knew about them first.)
0 kommentar(er)
