speedsitewx.blogg.se

1. METAMASK TROJAN VULNERABILITYON CHROME FOR A MAC PATCH
2. METAMASK TROJAN VULNERABILITYON CHROME FOR A MAC FULL

One of these bug fixes (issue 1196683) was intended to patch a vulnerability that was used during Pwn2Own, and both bug fixes were committed together with regression tests – JavaScript files to trigger these vulnerabilities. On April 12, 2021, the developers of Chromium committed two (issue 1196683, issue 1195777) Typer-related bug fixes to the open-source repository of V8 – a JavaScript engine used by Chrome and Chromium web browsers. According to the ZDI (Zero Day Initiative, the organizer of Pwn2Own) website, one participating team was able to demonstrate a successful exploitation of the Chrome renderer process using a Typer Mismatch bug. This is a computer hacking contest where the Google Chrome web browser was one of the targets. On April 6-8, 2021 the Pwn2Own competition took place.

METAMASK TROJAN VULNERABILITYON CHROME FOR A MAC FULL

Unfortunately, we were unable to retrieve the JavaScript with full exploit code, but the timeframe of attacks and events preceding it led us to suspect one particular vulnerability. Remote code execution exploitĪll of the observed attacks were conducted through Chrome browser. Both vulnerabilities were patched on June 8, 2021, as a part of the June Patch Tuesday. On April 20, 2021, we reported these vulnerabilities to Microsoft and they assigned CVE-2021-31955 to the information disclosure vulnerability and CVE-2021-31956 to the elevation of privilege vulnerability.

The elevation of privilege exploit was fine-tuned to work against the latest and most prominent builds of Windows 10 (17763 – RS5, 18362 – 19H1, 18363 – 19H2, 19041 – 20H1, 19042 – 20H2) and it exploits two distinct vulnerabilities in the Microsoft Windows OS kernel. While we were not able to retrieve the exploit used for remote code execution (RCE) in the Chrome web browser, we were able to find and analyze an elevation of privilege (EoP) exploit that was used to escape the sandbox and obtain system privileges. Closer analysis revealed that all these attacks exploited a chain of Google Chrome and Microsoft Windows zero-day exploits. On April 14-15, 2021, Kaspersky technologies detected a wave of highly targeted attacks against multiple companies.