Rewterz Threat Advisory – Google Chrome Affected By Magellan 2.0 Flaws

Severity

High

Analysis Summary

Five vulnerabilities in Google Chrome that stem from SQLite could enable remote code execution. Dubbed Magellan 2.0, the flaws exist in the SQLite database management system. SQLite is a lightweight, self-contained database engine utilized widely in browsers, operating systems and mobile phones. Researchers were able to successfully exploit the Chrome browser leveraging the five vulnerabilities: CVE-2019-13734, CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753. The vulnerabilities could be exploited remotely via a crafted HTML page to launch an array of malicious attacks – allowing attackers to do anything from “bypass defense-in-depth measures” to “obtain potentially sensitive information from process memory.”

“If you are using a software that is using SQLite as component (without the latest patch), and it supports external SQL queries… Or, you are using Chrome that is prior to 79.0.3945.79 and it enabled WebSQL, you may be affected”, reports the advisory. The official fixed Chrome version 79.0.3945.79 has been released.

Impact

• Remote Code Execution
• Security Bypass
• Information Disclosure

Affected Vendors

Google

Affected Products

Chrome/Chromium browsers prior to version 79.0.3945.79 with WebSQL enabled

Remediation

• If your product uses Chrome/Chromium, please update to the official stable version 79.0.3945.79.
• If your product uses SQLite, please update to the newest code commit.