An Indian security researcher has publicly published a proof-of-concept (PoC) exploit code for a newly discovered flaw impacting Google Chrome and other Chromium-based browsers like Microsoft Edge, Opera, and Brave.
Keith and Baumstark were awarded $100,000 for leveraging the vulnerability to run malicious code inside Chrome and Edge.
It appears that Agarwal was able to put together the PoC by reverse-engineering the patch that Google’s Chromium team pushed to the open-source component after the details of the flaw were shared with the company.
“Getting popped with our own bugs wasn’t on my bingo card for 2021,” Baumstark tweeted. “Not sure it was too smart of Google to add that regression test right away.”
While Google has addressed the issue in the latest version of V8, it’s yet to make its way to the stable channel, thereby leaving the browsers vulnerable to attacks. Google is expected to ship Chrome 90 later today, but it’s not clear if the release will include a patch for the V8 flaw.
We have reached out to Google, and we will update the story if we hear back.