What you need to know
- Google has patched a mysterious zero-day in Chrome.
- The firm is aware an exploit exists in the wild and has yet to detail the vulnerability while the patch rolls out to users.
- The patch is currently available for Windows, Mac, and Linux.
Google this week released a patch to the latest version of Chrome, v80, aimed at squashing three vulnerabilities, including one mystery 0-day vulnerability that wasn't detailed.
Google didn't share any more information about the attack, and it's likely holding up until the patch has rolled out widely. Chrome OS v 80, which would presumably deliver the patch to Chromebooks, isn't available yet at the time of writing for example.
Ok, good, those are words. Why is that bad? Well, as explained by the security researchers over at Sophos:
A type confusion bug is where you are able trick a program into saving data for one purpose (data type A) but then using it later for a different purpose (data type B).
Imagine that a program is very careful about what values it allows you to store into memory when you are treating it as type B.
For example, if a 'type B' memory location keeps track of a memory address (a pointer, to use the jargon word), then the program will probably go to great lengths to stop you modifying it however you like.
Otherwise, you might end up with the power to read secret data from memory locations you aren't supposed to access, or to execute unknown and untrusted program code such as malware.
On the other hand, a memory location that's used to store something such as a color you just chose from a menu might happily accept any value you like, such as 0x00000000 (meaning completely transparent) all the way to 0xFFFFFFFF (meaning bright white and totally opaque).
So if you can get the program to let you write to memory under the low-risk assumption that it is storing a color, but later to use that "color" as what it thinks is a trusted memory address in order to transfer program execution into your malware code…
…you just used type confusion to bypass the security checks that should have been applied to the memory pointer.
TL:DR: If this vulnerability is actively exploited, malware can dress up as three kids in a trench coat and fool security checks meant to keep said malware out. Google has already fixed the vulnerability in Chrome for most people, so feel free to update your browser for maximum protection.
We may earn a commission for purchases using our links. Learn more.
Reminder: Most people don't know or care what processor is in their phone
Every time there's a debate over which processor a phone has, I have to remind the smartphone enthusiasts that the average phone buyer has no idea what processor is in their phone — and that more of us should follow the same thought process.
Google accidentally leaked the Android 11 beta to some Pixel owners
Instead of getting the June 2020 security patch, some Pixel owners were treated to a leaked build of the Android 11 beta. Here's what it looks like.
Shadow of Death 2 is what a mobile 2D hack-and-slash should be
For this week, we're taking a look at the Early Access sequel to the popular Shadow of Death. This 2D hack-and-slash is tons of fun, easy to pick up and play, and just generally a great time killer.
These apps make it easy to check the specs of your phone with ease
While the Settings app on your phone does a decent job at telling you some of the specs on your smartphone or tablet, it doesn't tell you everything. Luckily, there are a plethora of apps that allow you to not only check your phone's specs, but so much more.