Chrome Vulnerabilities Let Attackers Execute Arbitrary Code and Crash System
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Google has released a critical security update for the Chrome Stable channel, addressing two high-severity vulnerabilities that expose users to potential arbitrary code execution (ACE) and denial-of-service<\/a> (DoS) attacks.<\/p>\n The update pushes the browser version to 144.0.7559.132\/.133 for Windows and macOS, and 144.0.7559.132 for Linux.<\/p>\n The technology giant confirmed that the rollout will occur over the coming days and weeks. These patches specifically target memory corruption issues within the browser\u2019s JavaScript engine and video processing libraries.<\/p>\n The update resolves two specific security flaws, both classified as \u201cHigh\u201d severity. Successful exploitation of these vulnerabilities typically requires a user to visit a specially crafted website, which can trigger the exploit within the browser\u2019s renderer process.<\/p>\n The most significant flaw is located in V8, Google\u2019s open-source high-performance JavaScript and WebAssembly engine. Type Confusion vulnerabilities occur when the engine is tricked into accessing a memory resource using an incompatible type for example, treating an integer as a pointer.<\/p>\n Attackers frequently leverage V8 type confusion bugs to manipulate memory pointers. This manipulation allows them to read or write memory out of bounds, potentially leading to arbitrary code execution within the sandboxed environment. This vulnerability was reported by researcher Chaoyuan Peng (@ret2happy).<\/p>\n The second vulnerability resides in In this context, an attacker could embed a malformed video stream on a webpage. When Chrome attempts to process this video using CVE-2026-1862: Type Confusion in V8<\/strong><\/h2>\n
CVE-2026-1861: Heap Buffer Overflow in libvpx<\/strong><\/h2>\n
libvpx<\/code>, the reference software library for the VP8 and VP9 video coding formats. A heap buffer overflow occurs when a process attempts to write more data to a fixed-length memory buffer than it can hold.<\/p>\nlibvpx<\/code>, the overflow could corrupt adjacent memory on the heap. This usually results in a browser crash (DoS) but can also be chained with other exploits to achieve code execution.<\/p>\n