It has been an interesting few days for Apple’s Security Engineering and Architecture (SEAR) team. Last week, SEAR unveiled its Private Cloud Compute challenge for hackers to secure $1m by breaking its new, “game-changing” AI platform—a major threat to Android’s equivalent. And now there’s an unexpected twist, with that same Apple security team triggering an emergency update for 2 billion Chrome users.
On Tuesday, Google updated Chrome’s stable release for Windows and Mac to 130.0.6723.91/.92. There were two security updates, the first being CVE-2024-10487, the critical flaw disclosed by Apple, and the second being CVE-2024-10488, a lower-risk WebRTC flaw disclosed by a private researcher.
The threat exposed by Apple’s team is an “out of bounds write in Dawn.” If exploited this could allow hackers to access system memory outside the set parameters, prompting application or system crashes. This was reported by Apple less than a week prior to the update, which equates to an emergency update for users.
Attacks leveraging this flaw would be executed by way of a maliciously crafted webpage, with users lured by way of links in emails, messages or social media posts. It would be highly likely to be exploited as part of a chain, opening a device to the risks of immediate data theft or the installation of longer-term malware.
Addressing such risks is a monthly game of cat and mouse for Google, as we saw with the news this week that a researcher has now released a tool to bypass Google’s latest encryption technology to better protect security cookies on devices. These security cookies allow users to log into websites without re-entering credentials, and cookie theft is the kind of attack that might exploit these latest memory vulnerabilities.
Ironically, Google’s addition of this technology to Chrome for Windows mirrors the existing security that Apple operates on macOS. Given the level of privileges required to beat the new technology, Google remains confident it has raised the bar.
As ever, there is no further detail on the new threats at this time. Google explains that “Access to bug details and links may be kept restricted until a majority of users are updated with a fix. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed.”
Given this was disclosed by Apple’s high-end security team and has been so rapidly fixed, all users should check that the update has been downloaded, and then restart Chrome to ensure it installs properly. Update instructions can be found here.
