Google patches a mystery zero-day Chrome vulnerability

Google this week released a patch to the latest version of Chrome, v80, aimed at squashing three vulnerabilities, including one mystery 0-day vulnerability that wasn't detailed.

Latest Chrome update patches CVE-2020-6418, 0day found in the wild by @_clem1 : https://t.co/H2j5PXO8gV pic.twitter.com/K2GoOJCPgf

— Antti Tikkanen (@anttitikkanen) February 24, 2020

Google didn't share any more information about the attack, and it's likely holding up until the patch has rolled out widely. Chrome OS v 80, which would presumably deliver the patch to Chromebooks, isn't available yet at the time of writing for example.

So what exactly is this mystery bug? The clue lies in the name. Google calls it a 'type confusion' error in V8 (Chrome's javascript engine).

Ok, good, those are words. Why is that bad? Well, as explained by the security researchers over at Sophos:

A type confusion bug is where you are able trick a program into saving data for one purpose (data type A) but then using it later for a different purpose (data type B).

Imagine that a program is very careful about what values it allows you to store into memory when you are treating it as type B.

For example, if a 'type B' memory location keeps track of a memory address (a pointer, to use the jargon word), then the program will probably go to great lengths to stop you modifying it however you like.

Otherwise, you might end up with the power to read secret data from memory locations you aren't supposed to access, or to execute unknown and untrusted program code such as malware.

On the other hand, a memory location that's used to store something such as a color you just chose from a menu might happily accept any value you like, such as 0x00000000 (meaning completely transparent) all the way to 0xFFFFFFFF (meaning bright white and totally opaque).

So if you can get the program to let you write to memory under the low-risk assumption that it is storing a color, but later to use that "color" as what it thinks is a trusted memory address in order to transfer program execution into your malware code…

…you just used type confusion to bypass the security checks that should have been applied to the memory pointer.

TL:DR: If this vulnerability is actively exploited, malware can dress up as three kids in a trench coat and fool security checks meant to keep said malware out. Google has already fixed the vulnerability in Chrome for most people, so feel free to update your browser for maximum protection.

Chrome: Everything you need to know!