Uh-oh, update Google Chrome – exploit already out there for one of these 6 security holes

Google has rolled out six Chrome security fixes including one emergency patch for a bug for which exploit code is already out there. You're encouraged to thus grab the latest updates for the browser. This latest zero-day flaw, tracked as CVE-2023-6345, is a high-severity integer overflow vulnerability in Skia, a popular graphics library used by Chrome. To exploit this bug, an attacker would need to have already compromised the renderer process, at which point they may be able to perform a sandbox escape via a malicious file. "Google is aware that an exploit for CVE-2023-6345 exists in the wild," according to the Chocolate Factory. Google doesn't provide a whole lot of detail about the bug, nor any details about who may be exploiting it and to what nefarious end. It does note, however, that Benoît Sevens and Clément Lecigne, both members of Google's Threat Analysis Group (TAG), found and reported the vulnerability, which indicates it could have been abused to deploy spyware on victims' machines — TAG tracks more than 30 commercial spyware vendors selling exploits and surveillance tools. Meanwhile, networking kit vendor Zyxel issued patches for six vulnerabilities, including three critical 9.8-rated bugs that could allow an unauthenticated attacker to execute some operating system (OS) commands on network-attached storage (NAS) products. The vulnerabilities include: The flaws affect model NAS326, versions 5.21(AAZF.14)C0 and earlier, and can be fixed by updating firmware to V5....