But given that the vast majority of the world’s internet browsing happens on Chrome, you need to make sure yours is up to date. Google did not return a request for comment. But one relates to Google’s V8 JavaScript and WebAssembly engine, and the other is in the IndexedDB API, which lets you store data in a user’s browser.Īgain, it’s not clear what attackers are using this, or how, or against whom. Google plans to withhold details “until a majority of users are updated with a fix,” according to its security advisory. On Monday Google pushed updates for two Chrome vulnerabilities that it says exploits exist for in the wild. While that means they are not a threat to the overwhelming majority of our users, we continue to work tirelessly to defend all our customers, and we are constantly adding new protections for their devices and data.”Īnd then there’s Chrome, the ubiquitous browser.
“Attacks like the ones described are highly sophisticated, cost millions of dollars to develop, often have a short shelf life, and are used to target specific individuals. “We’d like to commend Citizen Lab for successfully completing the very difficult work of obtaining a sample of this exploit so we could develop this fix quickly,” said Apple head of security and engineering Ivan Krstić in a statement.
On September 13, Apple pushed fixes for all three. They ascertained not only that ForcedEntry targeted Apple’s image-rendering library, but that it affected macOS and watchOS in addition to iOS. You might rightly wonder: If these attacks were reported a few weeks ago-and the attack has been active since at least February-why is a fix only available now? The answer, at least in part, appears to be that Apple was working with incomplete information until September 7, when Citizen Lab discovered more details of the ForcedEntry exploit on the phone of an activist from Saudi Arabia.
0 kommentar(er)
