A new vulnerability has been discovered by Aleksandar Nikolic of Cisco Talos within the Chrome browser.
Cisco has officially released the details of this vulnerability on its site in a comprehensive report.
The vulnerability is found in Google PDFium’s JBIG2, which is directly related to the PDF reader, and as per the work done so far, the vulnerability shows up in Chrome’s version 67.0.3396.99.
The vulnerability itself is described as the system triggering an “out-of-bounds” reading of a PDF document that is not the normal variety but has been purposely drafted to cause this disturbance.
The Vulnerability Could Be Exploited
The worrying aspect of this vulnerability is that it could be easily exploited by a hacker from a remote control and command center and what further damage may result is left to the imagination of the victim.
The way it works is to first leak information which then gets exploited by the hacker to lure the victims into clicking links that take them to sites with malicious content.
As indicated, it is left to the fortune of the victim that he or she escapes with minimal damage and quickly gets out of such sites, or the antivirus prevents the page from opening.
Cisco Worked with Google to Solve the Issue
The unwritten rule followed within the ethical confines of cybersecurity experts is that if they come across any vulnerability in any system’s firmware, software or even hardware, they first inform the source developer of the program or the manufacturer as the case may be and allow them the time to come up with the patch or the solution to the issue.
Only if there is no due response from them, the researcher or the cybersecurity firm shares the vulnerability with the public at large through online forums or the media.
This is with the honorable intention of saving people from having to endure such risks for their computer systems and the data they may stand to lose forever.
Sticking to this practice, Cisco Talos had taken Google into confidence. Working together, they have come up with a solution to the vulnerability, which is now made available to the users.
With the issue being resolved, Cisco has since released the full report of the vulnerability. The experts strongly recommend that users update their Chrome browsers as quickly as possible.
Some More Details Worth Noting
If you are not familiar, PDFium was developed by Google and is widely employed in the Chrome browser as an open source PDF renderer.
PDFium has been in existence for long and only the latest version of the browser has been found to have the vulnerability.
Cisco’s report goes on to provide the line-by-line details of the episode occurring pinpointing the exact stage where the vulnerability gets triggered, exposing the system.
The proof-of-concept is then presented and the researcher has captured the details for the benefit of the technical professionals who can understand the code execution and where is all goes wrong within the victim’s system.
Many of these minute details have helped the team at Google easily develop the patch. The update is available here.
Keep Your Systems and Software Updated
Every time a new malware is detected or as in this instance, a vulnerability is noticed, it would only go towards making the case stronger for keeping all ends protected as far as computer networks, individual systems and any connected device, mobile or tablet are concerned.
And there is no simple or one-off way to ensure this. You will have to first make sure your system is clean and safe.
For this, you need to have a good antivirus package, even if it means spending a few dollars a month or a year.
Then make sure you have a safe and secure internet connection. Install a VPN if it helps to escape any vulnerability in the Wi-Fi router.
And, as always, update your programs according to the releases and patches issued by the product’s developers.