ALERT: Apply Emergency Update to Chrome
Tuesday, June 6, 2023
This message is intended for U-M IT staff who are responsible for university systems running Google Chrome and for individuals running Chrome on their own devices.
Summary
A vulnerability has been discovered in Google Chrome which could allow for arbitrary code execution. Patches to Google Chrome should be applied immediately after appropriate testing.
Problem
Multiple vulnerabilities have been discovered in Google Chrome, the most severe of which could allow for arbitrary code execution. Problem is detailed in CVE-2023-3079.
Threats
CVE-2023-3079 is being actively exploited in the wild.
Affected Versions
Google Chrome versions prior to 114.0.5735.110 for Windows. Google Chrome versions prior to 114.0.5735.106 for Mac and Linux.
Action Items
Due to reports of active exploitation of this vulnerability, the need for immediate action supersedes the remediation timeframes in Vulnerability Management (DS-21).
Update Chrome for versions prior to 114.0.5735.110 for Windows and Chrome versions prior to 114.0.5735.106 for Mac and Linux as soon as possible after appropriate testing.
To update Chrome:
- To find out what version of Chrome you are running, go to the Chrome menu at the top right (three dots) > Help > About Google Chrome.
- To update Chrome, click Update Google Chrome and click Relaunch. For more information, see Update Google Chrome.
At this time it is unknown if mobile versions are impacted, as full details about the vulnerability have not been released. ITS Information Assurance recommends applying all Chrome security updates as soon as possible, including on mobile devices.
Technical Details
The vulnerability is due to a high-severity type confusion weakness in the Chrome V8 JavaScript engine.
How We Protect U-M
ITS provides CrowdStrike Falcon to units, which should be installed on all U-M owned systems (Windows, MacOS, and Linux operating systems, whether workstations or servers). Falcon administrators in ITS and in U-M units use the Falcon console to investigate and remediate issues. Additionally:
- ITS Information Assurance (IA) monitors a number of sources for information about new vulnerabilities and threats and provides up-to-date information to the university community.
- IA performs regular vulnerability scans of university networks to identify vulnerable devices and request remediation and provides vulnerability management guidance to the university.
Information for Users
MiWorkspace-managed machines are being updated; users will need to relaunch Chrome after the update to begin using the new version. To relaunch Chrome, go to the Chrome menu at the top right (three dots) > Help > About Google Chrome > click Relaunch.
In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open shared documents or email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Phishing & Suspicious Email, Secure Your Devices, and Secure Your Internet Connection on the U-M Safe Computing website.
Questions, Concerns, Reports
Please contact ITS Information Assurance through the ITS Service Center.
References
- CVE-2023-3079 (CVE.org, 6/5/2023)
- Chrome Stable Channel Update for Desktop, June 5 (Google Chrome Releases, 6/5/2023)
- A Vulnerability in Google Chrome Could Allow for Arbitrary Code Execution (Center for Internet Security, 6/5/2023)
- Google fixes new Chrome zero-day flaw with exploit in the wild (Bleeping Computer, 6/6/23)