Audio & Video Tags Exploited For Collecting Sensitive Data in Google Chrome: Update Now

Ron Masas, a security researcher, working with Imperva, has recently flagged a vulnerability in Google Chrome that leveraged audio and video tags for launching the attack.

In an article published by Masas, the root cause of the vulnerability is said to be Chrome’s rendering engine Blink, which is responsible for the behavior of audio and video tags. Hackers could inject the malicious codes into audio and video tags to monitor the response to the requests made to web platforms such as Facebook, Google, etc.

The bug monitors the progress events generated by these events and grants visibility into the original size of the requested resource. The retrieved information could be used for asking questions about the users on social media platforms.

Normally, CORS (Cross-Origin Resource Sharing) feature of browsers does not allow the sharing of resources from other websites but the bug bypasses CORS.

According to Masas, “In its essence, the bug allows attackers to estimate the size of cross-origin resources using the video or audio tags.”

Mike Gualteri, another security researcher, has said that the vulnerability could be exploited in several other scenarios as well except social media platforms. According to him, bad actors could target corporate backends, intranets and enterprise-centric applications to snoop on the information.

Soon after its discovery, Masas reported the vulnerability to the Google under CVE-2018-6177, and it has been patched with the release of Chrome v68.0.3440.75.

If you have not updated your Chrome to the latest version, it is advised that you must update immediately.

Also Read: Add-on Recommended By Mozilla Caught Logging Users’ Browsing History