There is a remote code execution (RCE) flaw that affects Google Chrome.
“The [type confusion] vulnerability results from incorrect optimization by the turbofan compiler, which causes confusion between access to an object array and a value array, and therefore allows to access objects as if they were values by reading them as if they were values (thus receiving their in memory address) or vice-versa to write values into an object array and thus being able to fake objects completely,” vulnerability broker Beyond Security said in a post.
Details about the bug came to vulnerability broker Beyond Security from an independent security researcher, and then sent the information over to Google.
The bug was found in version 59 of the browser, and it possibly affects earlier versions, but apparently stopped working in Chrome 60 and, according to Beyond Security, Google has no plan to address it.
Beyond Security released more details on the vulnerability along with proof of concept, and a patch.
Google Chrome users should upgrade to version 60 as soon as possible.