Security specialist Sophos has issued an urgent warning to Chrome users after discovering an alarming security flaw present across Windows, Mac and Linux.
While the bug itself remains a secret, Google has shared the exploit’s codename CVE-2020-6457 along with a brief description: “Use after free in speech recognizer.” It's worth mentioning, that after some digging, the US government’s National Vulnerability Database has marked this mysterious flaw as “Reserved.”
Sophos explained this further: "In some cases, use-after-free bugs can allow an attacker to change the flow of control inside your program, including diverting the CPU to run untrusted code that the attacker just poked into memory from outside, thereby sidestepping any of the browser’s usual security checks or ‘are you sure’ dialogs.
“That’s the most serious sort of exploit, known in the jargon as RCE, short for remote code execution, which means just what it says - that a crook can run code on your computer remotely, without warning, even if they’re on the other side of the world.”
Should Sophos’ assessment be accurate, it would come as no surprise that Google would want to keep the details of this exploit under wraps until most Chrome and Chromium users have updated their browsers.
Google is currently rolling out Chrome 81.0.4044.113 on Windows, Mac, and Linux. To check your version of Chrome, select the hamburger menu in the top right corner of your browser, then click “Help “ and “About Google Chrome.”
If you’re not running the most recent version of Chrome, we recommend updating your browser immediately. That said, your browser should update automatically once you check the version in the “About Google Chrome” page.
