Use of Released Resource in FontAccess in Google Chrome

Executive Summary

This vulnerability in Google Chrome prior to version 155.0.8059.39 involves a flaw in the FontAccess feature. A remote attacker who already compromised the renderer process could exploit a released resource to bypass the web origin policy. This means they could access or manipulate data from different websites than intended, potentially leading to unauthorized actions or data exposure.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability is specific to Google Chrome versions prior to 155.0.8059.39. Detection involves checking the installed Chrome version. On Windows, run: chrome://settings/help. On Linux/macOS, check via terminal: google-chrome --version or chromium-browser --version. If the version is below 155.0.8059.39, the system is vulnerable.

Useful 0 Not Useful 0

Impact Analysis

If you use an affected version of Google Chrome, this vulnerability could allow an attacker who has already gained control of the renderer process to bypass security restrictions. This might result in unauthorized access to sensitive data, cross-origin attacks, or further exploitation of your system through crafted HTML pages.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows a remote attacker to bypass web origin policy via a crafted HTML page, which could lead to unauthorized data access or manipulation. This may impact compliance with GDPR (data protection) and HIPAA (privacy and security) by potentially exposing sensitive user data or violating access controls.

Useful 0 Not Useful 0

Mitigation Strategies

Update Google Chrome to version 155.0.8059.39 or later to address the vulnerability.

Useful 0 Not Useful 0