New Chrome Zero-Day

Previous discussion: <a href="https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21425804" rel="nofollow">https:&#x2F;&#x2F;news.ycombinator.com&#x2F;item?id=21425804</a>

Was already patched on Oct 31 <a href="https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2019&#x2F;10&#x2F;stable-channel-update-for-desktop_31.html" rel="nofollow">https:&#x2F;&#x2F;chromereleases.googleblog.com&#x2F;2019&#x2F;10&#x2F;stable-channel...</a>

I would suggest we put the date in these kind of 0 day titles. Nov 4 in this case...

Why would cybercriminals not just report the bug and pick up the cash from Google? Is it genuinely that much more lucrative to exploit it?

The CVE is still embargoed[1] as of the time of this comment. =&#x2F;<p>[1] <a href="https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2019-13720" rel="nofollow">https:&#x2F;&#x2F;nvd.nist.gov&#x2F;vuln&#x2F;detail&#x2F;CVE-2019-13720</a>

I&#x27;m assuming this <i>doesn&#x27;t</i> affect Chromium, or Chromium(-based) browsers on Android then? Seeing as it isn&#x27;t mentioned.