← Advisories

Google Chrome Browser 111.0.5563.64 AXPlatformNodeCocoa Fatal OOM/Crash (macOS)

Medium
Advisory ID
ZSL-2023-5770
Release Date
11 April 2023
Vendor
Google LLC - https://www.google.com
Affected Version
111.0.5563.64 (Official Build) (x86_64), 110.0.5481.100 (Official Build) (x86_64), 108.0.5359.124 (Official Build) (x86_64), 108.0.5359.98 (Official Build) (x86_64)
CVE
N/A
Tested On
macOS 12.6.1 (Monterey), macOS 13.3.1 (Ventura)
Summary

Google Chrome browser is a free web browser used for accessing the internet and running web-based applications. The Google Chrome browser is based on the open source Chromium web browser project. Google released Chrome in 2008 and issues several updates a year.

Description

Fatal OOM/crash of Chrome browser while detaching/attaching tabs on macOS.

Proof of Concept
google_chrome_oom.txtTXT
Disclosure Timeline
08.12.2022Vulnerability discovered.
13.12.2022Contact with the vendor, ticket 1400682 created.
13.12.2022Vendor begins investigation.
10.04.2023Vendor releases version 112.0.5615.49 to address this issue.
11.04.2023Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
[1]https://bugs.chromium.org/p/chromium/issues/detail?id=1400682
[2]https://chromium-review.googlesource.com/c/chromium/src/+/3861171
[3]https://www.exploit-db.com/exploits/51361
[4]https://packetstormsecurity.com/files/171829/
Changelog
11.04.2023Initial release
20.04.2023Added reference [1] and [2]