Google Chrome contains a flaw in the IPC channel handling as the identity of a listener process is not validated. This allows an unprivileged listener process to connect to a pipe started by the browser process and escalate privileges, e.g. allowing the GPU process to impersonate a special class of renderer with elevated privileges.
Classification
Location:
Local Access Required
Attack Type:
Authentication Management
Impact:
Loss of Integrity
Solution:
Upgrade
Exploit:
Exploit Private
Disclosure:
Vendor Verified,
Coordinated Disclosure
OSVDB:
Vuln Dependent,
Web Related
Solution
Upgrade to version 18.0.1025.168 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.
