{"id":99342,"date":"2023-11-30T10:55:47","date_gmt":"2023-11-30T18:55:47","guid":{"rendered":"https:\/\/www.intego.com\/mac-security-blog\/?p=99342"},"modified":"2023-12-28T14:07:58","modified_gmt":"2023-12-28T22:07:58","slug":"urgent-patch-7th-chrome-zero-day-of-2023-affects-multiple-browsers","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/urgent-patch-7th-chrome-zero-day-of-2023-affects-multiple-browsers\/","title":{"rendered":"Urgent patch: 7th Chrome zero-day of 2023 affects multiple browsers"},"content":{"rendered":"\r\n

\"\" On Tuesday, November 28, the Google Chrome<\/a> browser was updated to version 119.0.6045.199 to address a zero-day vulnerability that has been actively exploited in the wild. This is the seventh such vulnerability this year.<\/p>\r\n

Google says that it “is aware that an exploit for CVE-2023-6345 exists in the wild.” This means that users must install patches urgently.<\/strong> This particular vulnerability exists in Chromium’s Skia graphics library.<\/p>\r\n

Whenever Chrome gets a security update, other browsers based on the Chromium<\/a> open-source Web browser project generally require an update, too. Notable browsers built upon the Chromium codebase include\u00a0Microsoft<\/b>\u00a0Edge<\/strong>, Brave<\/strong>, Vivaldi<\/strong>, Opera<\/strong>, and\u00a0Opera GX<\/strong>.<\/p>\r\n

Vivaldi<\/a> also released an update on November 28. Microsoft Edge<\/a> and\u00a0Brave<\/a> browsers received updates on Wednesday, November 29.<\/p>\r\n

As usual, Opera took longer than other Chromium-based browsers to release a critical security update. Opera finally released a security update<\/a> for its main desktop browser on Thursday, November 30.<\/p>\r\n

However, Opera GX, which is billed as a “gaming browser,” apparently remained vulnerable<\/strong> as of when this article was first published. In fact, the latest Opera GX version is based on an old Chromium build from more than five weeks ago<\/a>.\u00a0Update: <\/strong>The Opera Security Team wrote a blog post on December 1<\/a> claiming that Opera GX has been updated to address the vulnerability. However, an old Chromium build from October 24, version 118.0.5993.118, remains the basis for the latest Opera GX; this may mean that Opera has implemented its own custom patch.<\/p>\r\n

How to update Chromium-based desktop browsers<\/h3>\r\n

Mac users can update their Chrome, Edge, Brave, or Opera browsers<\/strong> by clicking on the application menu (e.g. “Chrome” or “Microsoft Edge,” next to the Apple logo menu), and then clicking the first item in that menu (e.g. “About Google Chrome” or “About Microsoft Edge”). The browser will check for updates, and if an update is available, it will prompt you to restart the app to complete the update.<\/p>\r\n

Vivaldi<\/strong> for macOS has a slightly different update procedure. After clicking on the Vivaldi menu (next to the Apple menu), click on “Check for Updates\u2026” to ensure you have the latest version installed.<\/p>\r\n

Windows users can update their browsers<\/strong> by following the steps provided by each browser maker: Chrome<\/a>, Edge<\/a>, Brave<\/a>, Vivaldi<\/a>, Opera<\/a>.<\/p>\r\n

How to update Chromium-based mobile browsers<\/h3>\r\n

Android users<\/strong> should check the Google Play Store app for the latest versions of their browsers and other apps.<\/p>\r\n

Mobile browsers on iOS and iPadOS<\/strong> use Safari’s WebKit engine, rather than Chromium’s Blink and V8 engines. Therefore, this particular vulnerability does not affect the iOS or iPadOS versions of any Web browsers. If you would like to update your iPhone and iPad browsers anyway, you can do so via the App Store. (Here’s how to manually check for and install updates<\/a>.)<\/p>\r\n

Sometime in early 2024, in future updates to iOS 17<\/a> and iPadOS 17, third-party app stores<\/a> may become a reality\u2014at least in the EU, for compliance with the Digital Markets Act. Apple must comply with the DMA no later than March 2024. Third-party stores may eventually distribute alternative browser versions that use their own engines, rather than the WebKit-locked App Store versions.<\/p>\r\n

Non-browser apps need updates, too<\/h3>\r\n

As we’ve noted in the past, many non-browser apps, including\u00a0Electron apps<\/a>, also rely on the Chromium browser codebase for rendering HTML content. These include the desktop versions of apps like 1Password, Discord, Dropbox, Figma, GitHub, Microsoft Teams, Signal, Skype, Slack, Trello, Twitch, WhatsApp, WordPress, and Zoom.<\/strong><\/p>\r\n

Notably, the Electron framework does not get updated in tandem with Chromium, so some Electron-based apps may remain vulnerable for months<\/a>. For this and other reasons, it’s important to keep all your other apps updated as well.<\/p>\r\n

To update Mac App Store apps<\/a>, open the App Store, then click Updates, and click on Update All.<\/p>\r\n

Other apps usually have their own separate in-app or separate update mechanisms. In some cases, you may need to update an app manually by downloading a new version from the developer’s site.<\/p>\r\n

Chromium vulnerabilities threaten Electron app security<\/a><\/blockquote>