Google has released Chrome update 147.0.7727.101, addressing 31 vulnerabilities, of which 5 are marked as critical. Critical issues allow bypassing all levels of browser protection and executing code on the system outside of the sandbox environment. Details have not been disclosed yet; it is only known that the vulnerabilities are caused by buffer overflows in the ANGLE layer (which translates OpenGL ES calls to other graphics APIs) and the Skia library (for 2D graphics rendering), as well as use-after-free errors in the prerendering mechanism, virtual reality (XR) components, and the implementation of Proxy objects.
Additionally, it is worth noting the analysis of Chrome's susceptibility to various hidden identification methods that can passively create browser identifiers based on indirect signs such as:
- screen resolution,
- the list of supported MIME types,
- specific parameters in HTTP/2 and HTTP/3 headers,
- analyzing installed fonts,
- availability of certain Web APIs,
- analyzing browsing history,
- graphics card-specific rendering features using WebGL, WebGPU, and Canvas,
- differences in the implementation of audio processing methods in the AudioContext API and speech recognition via the SpeechSynthesis API,
- local leaks IP via WebRTC,
- analysis of the composition and order of enumerating TLS extensions,
- features of emoji rendering,
- determination of keyboard layouts,
- availability of specialized peripherals and rare sensors (game controllers, virtual reality headsets, proximity sensors),
- differences in sensor calibration via the Generic Sensor API,
- identification of Bluetooth, USB, and HID devices via the getDevices() method,
- characteristics of mathematical functions (e.g., Math.tan(-1e308)),
- evaluation of color schemes and color processing data through the CSS @supports rule,
- binding to system performance via the Performance API,
- identification of installed extensions through enumeration of chrome-extension://[known-id]/[resource],
- CSS manipulations,
- and analyzing mouse and keyboard handling features.
It is noted that Chrome has almost no built-in mechanisms to protect against hidden identification, and previous initiatives to enhance privacy, such as Privacy Sandbox and Privacy Budget, have been discontinued. In addition to a general description of the methods of hidden identification used in Chrome, it demonstrates how to block them at the browser extension level by using content processing scripts, debugging capabilities (chrome.debugger), and analyzing network requests (chrome.webRequest). It also examines methods of storing identifiers in areas not intended for permanent information storage (such as "Supercookies", for example, Favicon cache, autofill database).
Source: opennet.ru
