# Google Patched an Actively-Exploited Zero-Day Bug in Chrome

**URL:** <https://onehack.st/t/google-patched-an-actively-exploited-zero-day-bug-in-chrome/160176>\
**Category:** News & Articles\
**Tags:** technology, browsers\
**Created:** [October 25, 2020, 1:02pm UTC](https://onehack.st/t/google-patched-an-actively-exploited-zero-day-bug-in-chrome/160176 "2020-10-25T13:02:13Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![Prometheus](https://onehack.st/user_avatar/onehack.st/prometheus/32/34950_2.png) [@Prometheus](https://onehack.st/u/Prometheus)\
**Post date:** [October 25, 2020, 1:02pm UTC](https://onehack.st/t/google-patched-an-actively-exploited-zero-day-bug-in-chrome/160176/1 "2020-10-25T13:02:13Z")

</div>

![image](https://onehack.st/uploads/default/original/3X/f/c/fc86b948ad1b0fb2f47da131cf8cdfb4399354e5.jpeg)

"Google released an [update](https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html) to its Chrome browser that patches [a zero-day vulnerability in the software’s FreeType font rendering library that was actively being exploited](https://threatpost.com/google-patches-zero-day-browser/160393/) in the wild, Threatpost reported this week:

_Security researcher Sergei Glazunov of [Google Project Zero](https://googleprojectzero.blogspot.com/) discovered [the bug](https://twitter.com/benhawkes/status/1318640422571266048) which is classified as a type of memory-corruption flaw called a heap buffer overflow in FreeType. Glazunov informed Google of the vulnerability on Monday. Project Zero is an internal security team at the company aimed at finding zero-day vulnerabilities._

 

By Tuesday, Google already had released a stable channel update, Chrome version 86.0.4240.111, that deploys five security fixes for Windows, Mac & Linux — among them a fix for the zero-day, which is being tracked as CVE-2020-15999 and is rated as high risk. “Google is aware of reports that an exploit for CVE-2020-15999 exists in the wild,” Prudhvikumar Bommana of the Google Chrome team wrote in a [blog post](https://chromereleases.googleblog.com/2020/10/stable-channel-update-for-desktop_20.html) announcing the update Tuesday… “The fix is also in today’s stable release of FreeType 2.10.4,” Ben Hawkes, technical lead for the Project Zero team, [tweeted](https://twitter.com/benhawkes/status/1318640423485624320). Meanwhile, security researchers took to Twitter to encourage people to update their Chrome browsers immediately to avoid falling victim to attackers aiming to exploit the flaw…

_In addition to the FreeType zero day, Google patched four other bugs — three of high risk and one of medium risk — in the Chrome update released this week… So far in the last 12 months Google has patched three zero-day vulnerabilities in its Chrome browser._