Google LLC has released a security update to its popular Chrome browser that addresses a vulnerability that’s being actively exploited in the wild.

The Chrome update addresses the vulnerability designated CVE-2023-2033, which Google describes as a “Type Confusion in V8” vulnerability discovered by Clément Lecigne of Google’s Threat Analysis Group on April 11. Although Google did not provide further details of the vulnerability, the Common Vulnerabilities and Exposure listing on the National Institute of Standards and Technology websites describes it as allowing a remote attacker potentially to exploit heap corruption via a crafted HTML page.

Google did warn, however, that it’s aware that an exploit for the vulnerability exists in the wild. The update to Chrome also addresses a range of minor issues and fixes from internal audits, fuzzing and other initiatives.

Seemingly overlooked in initial reports, the vulnerability isn’t unique to Chrome since it resides in the Chromium Open Software Software, which other companies use as the base code for their browsers. Notable among them is Microsoft Corp.’s Edge browser, which is bundled with Windows. In response to the vulnerability, Microsoft pulled the latest version of Edge, called 112.0.1722.48, on Friday.

Other browsers known to use Chromium as their base code include Vivaldi, Opera and the Brave Browser. Brave Software International Inc. announced on its Twitter account on Friday that it had released an update to address the issue.

Chrome has had issues that needed to be addressed in the past, including a patch for another unpatched vulnerability in November. That vulnerability, designated CVE-2022-4135, was a heap buffer overflow in GPU in Chrome. It allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page.

Google TAG also released a report late last month that detailed two campaigns that use various unpatched exploits against Android, iOS and Chrome. The vulnerabilities in Chrome had been patched, but it was noted that not all browsers that use Chrome and Chromium as their base had been updated. The report highlighted that the Samsung Electronics Co. Ltd. browser was using the same code base as Chrome 102, which was released in May 2022. The current version of Chrome today is 112.0.5615.121.

Photo: Needpix