WhatsApp has issued fixes for two security vulnerabilities impacting its app, one of which has been given a "critical" rating, according to TechCrunch.
Threat actors could exploit the critical integer overflow flaw, tracked as CVE-2022-36934 and found within WhatsApp's Video Call Handler component, to facilitate total app takeover, according to Malwarebytes. Such a bug, which has "no evidence of exploitation," resembles a vulnerability in WhatsApp's audio calling feature discovered in 2019 which had been abused to target devices of 1,400 individuals.
Meanwhile, the high-severity flaw, tracked as CVE-2022-27492, could be exploited by attackers to enable malicious code on an iOS device following malicious video file delivery.
"The manipulation with an unknown input leads to a memory corruption vulnerability. To exploit this vulnerability, attackers would have to drop a crafted video file on the users WhatsApp messenger and convince the user to play it," said Malwarebytes intelligence researcher Pieter Arntz.
Immediate updates have been advised for WhatsApp users.
Malicious Chrome web store extensions identified SecurityWeek reports that more than 30 malicious extensions in the Google Chrome web store with nearly 87 million total user downloads have been discovered to have obfuscated code enabling JavaScript code-injection by third-party websites to all visited websites.
Ninety-two more apps, nearly half of which are on Google Play, that have cumulatively amassed more than 30 million installations were discovered to be compromised with the SpinOk malware, which has been distributed through a malicious software development kit supply chain attack, BleepingComputer reports.
FedScoop reports that a new interim rule prohibiting the use of TikTok across all government employees' and contractors' devices has been released by the Department of Defense, General Services Administration, and National Aeronautics and Space Administration.