About the Vulnerability
Introduction
Google Chrome is a web browser developed by Google, which is based on other open-source software, including WebKit. The goal is to enhance stability, speed, and security, and to create a simple and efficient user interface.
Summary
On November 7, 2024, Sangfor FarSight Labs received notification that a Google-Chrome component contains information of use after free vulnerability(CVE-2024-10827), classified as high in threat level.
The Serial component in Google Chrome has a UAF (Use After Free) issue, and remote attackers can exploit this vulnerability to induce users to visit malicious web pages or scripts, causing the browser to crash or execute arbitrary code.
Affected Versions
Google Chrome < 130.0.6723.116
Solutions
Remediation Solutions
Check the System Version
Open Chrome browser, click on Settings ->About Chrome to check the current version
Official Solution
Affected users are strongly advised to update the version of Google Chrome.
Download link:
Sangfor Solutions
Risky Assets Detection
Support is provided for proactive detection of Google-Chrome; and it is capable of batch identifying the affected asset conditions of this event in business scenarios. Related products are as follows:
[Sangfor CWPP] has released an asset detection scheme, with Fingerprint ID: 0000398.
Timeline
On November 7, 2024, Sangfor FarSight Labs received notification of the Google Chrome Serial Use After Free Vulnerability.
On November 7, 2024, Sangfor FarSight Labs released a vulnerability alert.
References
https://chromereleases.googleblog.com/2024/11/stable-channel-update-for-desktop.html
