Beware! 2.5 Billion Google Chrome Users are at Risk

Google Chrome is a web browser that is used by billions of people all over the world. Imperva Red, a cyber security company, found a security flaw in Google Chrome and Chromium-based browsers. This puts the data of more than 2.5 billion users at risk.

You can open Table of Contents show

This flaw, which the company calls CVE-2022-3656, made it possible for sensitive files, like crypto wallets and cloud provider credentials, to be stolen.

“The vulnerability was found through a review of how the browser interacts with the file system. Specifically, the review looked for common flaws in how browsers handle symlinks,” the blog says.

What is a Symlink?

A symbolic link, or symlink, is what Imperva Red calls a file that points to another file or directory. It tells the operating system that the linked file or directory should be treated as if it were at the location of the symlink. It says that a symlink can be used to make shortcuts, change the path to a file, or arrange files in a more flexible way.

But if these links are not handled properly, they can also be used to open security holes.

In the case of Google Chrome, the problem was caused by how the browser handled symlinks when it worked with files and directories. In particular, the browser didn’t check if the symlink pointing to a place that wasn’t meant to be accessible. This made it possible for sensitive files to be stolen, as explained in the blog post.

How Symlinks Affected Google Chrome?

The company says that an attacker could make a fake website that offers a new crypto wallet service. This is how the vulnerability affected Google Chrome. The website could then trick the user into making a new wallet by asking them to download their “recovery” keys.

These keys would actually be a zip file that contained a symlink to a private file or folder on the user’s computer, such as a cloud provider password. “When the user unzips and submits the “recovery” keys back to the website, the symlink is processed, and the attacker has access to the sensitive file,” the researchers write. blog says.

What should Chrome Users do?

Imperva Red says it told Google about the security hole, and the problem was fixed in Chrome 108. Users should always keep their software up to date to protect themselves from these kinds of weaknesses.