ALERT: Update Google Chrome ASAP for Zero-Day Vulnerability (no action needed for CoreImage machines)

12/21/2023
Dark blue background with a white computer icon. On its screen is an exclamation mark.

This message is intended for U-M IT staff who are responsible for university devices running the Google Chrome web browser. No further action is needed for CoreImage users. It will also be of interest to individuals who have Chrome installed on their own devices.

 

Summary

Google has released an important update to the Google Chrome web browser for a zero-day vulnerability (CVE-2023-7024) that is being actively exploited in the wild. Update Chrome as soon as possible.

Problem

An exploit could potentially pose risks including crashes or execution of arbitrary code.

Threats

According to Google, an exploit for CVE-2023-7024 exists in the wild.

Affected Versions

  • Google Chrome versions prior to 120.0.6099.129 for Mac and Linux
  • Google Chrome versions prior to 120.0.6099.129/130 for Windows

Action Items

Due to reports of active exploitation of this vulnerability, the need for immediate action supersedes the remediation timeframes in Vulnerability Management (DS-21).

Update Google Chrome to the latest version as soon as possible. MiWorkspace-managed machines are being updated. Users will need to restart Chrome (or their computer) for the update to apply.

Google has made the new version available for personal devices. Users need to relaunch Chrome or restart their computers after the update.

To begin using the new version:

  1. Find out your version: Go to the Chrome menu at the top right (three dots) and select Help > About Google Chrome.
  2. Update Chrome: From the About page, click Update Google Chrome (if necessary) and click Relaunch. The relaunch retains the browser content you have open. For more information, see Update Google Chrome.

Technical Details

The vulnerability (CVE-2023-7024) is a heap-based buffer overflow bug in the WebRTC framework that could be exploited to result in program crashes or arbitrary code execution.

How We Protect U-M

ITS provides CrowdStrike Falcon to units, which should be installed on all U-M owned systems (Windows, macOS, and Linux operating systems, whether workstations or servers). Falcon administrators in ITS and in U-M units use the Falcon console to investigate and remediate issues.

Information for Users

MiWorkspace machines will be patched as soon as possible.

It is best to set Chrome on your own devices (those not managed by the university) to update automatically. Be aware that automatic updates to Chrome normally happen in the background when you close and reopen Chrome. If you seldom close and reopen Chrome, check for pending updates to Chrome and update if necessary.

In general, the best protection for your devices is this: keep your software and apps up-to-date, do not click suspicious links in email, do not open shared documents or email attachments unless you are expecting them and trust the person who sent them, and only use secure, trusted networks. For more information, see Phishing & Scams, Secure Your Devices, and Secure Your Internet Connection on the U-M Safe Computing website.