Google Patches Mysterious Chrome Zero-Day Exploited in the Wild

Google has released a security update for its Chrome browser to address a zero-day vulnerability that is actively being exploited in the wild. The flaw does not yet have a CVE identifier, and it is unclear who reported it or which browser component it affects; Google is identifying it with a bug tracker ID (466192044) and has marked it as under coordination.

The Chrome update, version 143, also fixes two medium-severity issues: a use-after-free in the password manager and an inappropriate implementation flaw in the toolbar component, with each of the reporting researchers receiving a $2,000 bug bounty. The article notes that, based on historical trends, such Chrome zero-days may relate to memory corruption issues within the V8 engine or a related component, potentially enabling sandbox escape or remote code execution.

It also states that Chrome zero-days are frequently exploited by government-sponsored espionage campaigns, which suggests the vulnerability could be part of a targeted attack rather than a widespread one. Written by Eduard Kovacs, the piece highlights that the disclosure and patch follow SecurityWeek’s typical pattern of brief flaw descriptions upon updates.