To: All Users

As informed by the Cybersecurity Incident Alert and Response Centre (CARIC), Google have recently issued a security vulnerability notice about Chrome. Attackers can use this vulnerability to trigger the execution of arbitrary code on the target system. There are signs that related vulnerabilities have been exploited recently. Please be reminded to to update as soon as possible. 

Related vulnerabilities

• CVE-2023-0696

Due to the type confusion vulnerability in Google Chrome’s V8 engine, attackers can perform corruption through HTML pages.

• CVE-2023-0697

Due to faulty implementation of full-screen mode in Android version of Google Chrome, attackers could trick security mechanisms with HTML pages.

• CVE-2023-0698

Due to the out-of-bounds read vulnerability in WebRTC in Google Chrome, attackers can perform out-of-bounds memory read through HTML page.

• CVE-2023-0699

Due to the Use-After-Free  weakness in the GPU in Google Chrome, attackers can perform corruption through HTML pages and browser shutdowns.

• CVE-2023-0700

Due to improper implementation of Google Chrome when downloading, attackers can use HTML pages to spoof the content of the URL bar.

• CVE-2023-0701

Due to the buffer overflow vulnerability in Web UI in Google Chrome, attackers can perform corruption by convincing the victim to participate in a specific UI interaction.

• CVE-2023-0702

Due to the type confusion weakness in data transfer in Google Chrome, attackers can perform corruption by tricking victims to participate in specific UI interactions.

• CVE-2023-0703

Due to the type confusion weakness in DevTools in Google Chrome, attackers can perform corruption by tricking victims to participate in specific UI interactions.

• CVE-2023-0704

Due to the poor policy enforcement in DevTools  in Google Chrome, attackers can bypass the same-origin policy and proxy settings through HTML pages.

• CVE-2023-0705

Due to integer overflow vulnerability in the core of Google Chrome, attackers can perform corruption via HTML pages.

Affected Products:

• Google Chrome version lower than 110.0.5481.77 (Linux and Mac) and 110.0.5481.77./78 (Windows)

For more details, please refer to: https://chromereleases.googleblog.com/2023/02/stable-channel-update-for-desktop.html

Mitigation
If the above-mentioned affected products are being used, please update the Google Chrome as soon as possible.

Reference

• How to download and install software in a secure manner?
• Basic Knowledge of Online Safety and Security
• Other Information Security Tips

Should you have any enquiries, please feel free to contact ICTO Help Desk.

ICTO Help Desk
Location : Room 2085, 2/F, Central Teaching Building (E5), eMap
Telephone : 8822 8600
email : icto.helpdesk@um.edu.mo

Information and Communication Technology Office