Five vulnerabilities in Google Chrome that stem from SQLite could enable remote code execution. Dubbed Magellan 2.0, the flaws exist in the SQLite database management system. SQLite is a lightweight, self-contained database engine utilized widely in browsers, operating systems and mobile phones. Researchers were able to successfully exploit the Chrome browser leveraging the five vulnerabilities: CVE-2019-13734, CVE-2019-13750, CVE-2019-13751, CVE-2019-13752, CVE-2019-13753. The vulnerabilities could be exploited remotely via a crafted HTML page to launch an array of malicious attacks – allowing attackers to do anything from “bypass defense-in-depth measures” to “obtain potentially sensitive information from process memory.”
“If you are using a software that is using SQLite as component (without the latest patch), and it supports external SQL queries… Or, you are using Chrome that is prior to 79.0.3945.79 and it enabled WebSQL, you may be affected”, reports the advisory. The official fixed Chrome version 79.0.3945.79 has been released.
Chrome/Chromium browsers prior to version 79.0.3945.79 with WebSQL enabled