Editor’s note: The original November 2023 version of this article was lost. The Lee Daily Register rebuilt it in October 2026 from the official advisories cited below, and added what happened afterward. The original version recommended a commercial VPN product; this version does not promote any product or service.
The web browser is the program most people use to bank, shop, work and read email, which makes it one of the most attractive targets on any computer. In 2023, attackers proved that point again and again.
Five Chrome zero-days by early November 2023
A “zero-day” is a flaw that attackers exploit before a fix is widely available. By early November 2023, Google had stated in five separate Chrome security updates that it was aware an exploit for a newly patched bug existed in the wild:
- April 14: CVE-2023-2033, a type confusion bug in Chrome’s V8 JavaScript engine, reported by Clément Lecigne of Google’s Threat Analysis Group (Chrome Releases).
- April 18: CVE-2023-2136, an integer overflow in the Skia graphics library (Chrome Releases).
- June 5: CVE-2023-3079, another V8 type confusion bug (Chrome Releases).
- Sept. 11: CVE-2023-4863, a heap buffer overflow in the code that handles WebP images (Chrome Releases).
- Sept. 27: CVE-2023-5217, a heap buffer overflow in VP8 video encoding in the libvpx library (Chrome Releases).
For the WebP flaw, Google’s notice used the same wording as the other four: “Google is aware that an exploit for CVE-2023-4863 exists in the wild.” Apple’s Security Engineering and Architecture team and the Citizen Lab at the University of Toronto reported that bug on Sept. 6.
It was not only a Chrome problem
The WebP bug sat in a shared image library, so other software was exposed too. Mozilla rated it critical and fixed it in Firefox 117.0.1, Firefox ESR 115.2.1 and 102.15.1, and two Thunderbird releases on Sept. 12, according to its security advisory. Mozilla said that opening a malicious WebP image could trigger the overflow and that it knew of the issue being exploited in other products.
The U.S. Cybersecurity and Infrastructure Security Agency added each of the five Chrome flaws to its Known Exploited Vulnerabilities catalog, each with a due date for fixing it. The WebP bug, for example, was added on Sept. 13 with an Oct. 4 due date.
Habits that close the gap
Chrome updates roll out over days or weeks, Google’s release notes say, so the gap between a patch and a protected computer depends partly on the user. CISA’s guidance on safer browsing includes these habits (its browser-settings tips are aimed first at people at higher risk, but the basics apply to anyone):
- Turn on automatic updates and install them promptly, especially for browsers, instead of choosing “remind me later,” as CISA’s software update guidance puts it.
- Close and restart the browser regularly, because some browsers download updates on their own but only apply them after a restart, according to CISA’s browser settings tips.
- Vet browser extensions before adding them, as CISA’s browser settings tips advise.
- Block third-party cookies, and deny location, camera and microphone access to sites that do not need it.
- Be wary of sites asking to send pop-up notifications, which CISA flags as a phishing and malware risk.
- Turn on multifactor authentication for any Google, Microsoft or other account you sign into through the browser.
What happened next
Two more exploited Chrome flaws followed before the year ended. On Nov. 28, Google fixed CVE-2023-6345, an integer overflow in Skia, in Chrome 119.0.6045.199, its release notes show; CISA added it to its catalog two days later. On Dec. 20, Google patched CVE-2023-7024, a heap buffer overflow in WebRTC reported by its Threat Analysis Group the day before, in Chrome 120.0.6099.129 (Chrome Releases). CISA added that flaw to the catalog on Jan. 2, 2024.
