Chrome vulnerabilities underscore the need for modern endpoint protection

Last week Google announced another security fix that addresses a vulnerability apparently exploited in the wild.

Tracked as CVE-2023-2136, this one is an integer overflow issue in a library called Skia, used by the web browser to render web content. Users (and admins) should update to at least Chrome v112.0.5615.137 to fix the issue.

The vulnerability made it into CISA's known exploited vulnerabilities database, although there are no details on how widely the exploit is being deployed by malware actors.

In any case, this vulnerability comes just a few days after a similar Chrome bug was patched by Google, also known to be exploited in the wild (CVE-2023-2033).

Both bugs could essentially make it into drive-by download exploit kits usually deployed on compromised web servers. Unsuspecting users visiting such web pages could inadvertently install malware on their devices.

Google Chrome is being widely used by billions of internet users, so prompt patching will always be difficult, even in relatively small organizations.

As the number of vulnerabilities discovered each year is still growing by 20%+, having robust endpoint detection & response (EDR/XDR) capabilities is becoming even more important. XDR is the new baseline for endpoint protection, now that antimalware detection is a commodity enabled by default at operating system level.