Google Chrome and Microsoft Edge Zero-day Remote Code Execution Vulnerability

The second and effective zero day on Chromium-based browsers such as Google Chrome and Microsoft Edge was posted consecutively, just after yesterday’s zero-day RCE. This time, Frust, a security researcher, tweeted about a zero-day remote code execution vulnerability creating havoc in the browser-based vulnerability trend. He has released a working proof-of-concept exploit.

Unless a threat actor chains the new zero-day with an unpatched sandbox escape vulnerability, the new zero-day in its current state cannot harm users unless they disable the sandbox. Browser’s sandbox is a security protection that prevents malicious code from reaching the underlying OS.

Once the sandbox is disabled, the PoC exploits browsers to launch the notepad app on Windows 10 devices. At Qualys labs, we’ve tried to recreate the lab environment and successfully tested the PoC on latest deployment of Chrome (90.0.4430.72) as well as Microsoft Edge (89.0.774.77) browsers.