The Indian Computer Emergency Response Team (CERT-In) under the Ministry of Electronics and Information Technology has discovered multiple vulnerabilities in Samsung Galaxy Store app, Microsoft apps and Google Chrome that could put many users at risk. These vulnerabilities, if exploited, could allow attackers to gain unauthorised access to device, take control of the device or cause other serious security breaches. All these vulnerabilities have been rated as high severity which means they pose a significant threat to users and should be addressed immediately.
Samsung Galaxy Store app prior to version 4.5.49.8 has a security vulnerability that could allow a malicious mind to install unwanted app or run arbitrary code on the target device. Specifically, this vulnerability could allow an attacker to craft a malicious update for the app which when installed by the user can execute an arbitrary code on the device. Attacker can use it to install unwanted apps from Galaxy Store app or run malicious code on the device. CERT-In highlights that this vulnerability does not exist for those running Android 13. This vulnerability in Samsung Galaxy Store is caused due to an “incorrectly configured filter in webview.” The users of Samsung Galaxy Store app are advised to update their app to the latest version
Users of Google Chrome have also been warned of high severity rated vulnerabilities by CERT-In. The organisation in its research found multiple vulnerabilities in Google Chrome, which if exploited, could allow attackers to run arbitrary code in context of user logged in and gain access to sensitive data on device. The Chrome versions prior to 109.0.5414.119/.120 on Windows and versions prior to 109.0.5414.119 on Mac or Linux are affected by these vulnerabilities. Users are advised to update to the latest version of Google Chrome as soon as possible to prevent any potential threat.
Microsoft services that are widely used by businesses for communication and productivity has also been reported of vulnerabilities by CERT-In. Microsoft Windows, Microsoft Office, Microsoft Apps, Microsoft Azure, Microsoft SharePoint, Microsoft Exchange Server, Microsoft Visio, and Microsoft Tools are the software affected by vulnerabilities that could allow attacker to gain “elevated privileges, obtain sensitive information, conduct remote execution attacks, bypass security restrictions, conduct spoofing attacks, or cause denial of service conditions.” Users are recommended to download security updates shared by the company.