SQLite flaws left Chrome open to remote code execution before being patched two weeks ago, were found by Tencent researchers a year after revealing similar bugs
Magellan 2.0 vulnerabilities were patched in Google Chrome 79.0.3945.79. — A new set of SQLite vulnerabilities can allow attackers …
Context & Ripple Effects
Tencent's researchers are back on SQLite: a year after their first round of findings against the embedded database, they have disclosed Magellan 2.0, a new set of flaws that allowed remote code execution inside Chrome. Google had already shipped the fix quietly in Chrome 79.0.3945.79 about two weeks before the disclosure went public.
The episode fits a pattern in Chrome's security record rather than standing alone — earlier in 2019 Google confirmed a sandbox-escaping zero-day that was actively exploited in a routine patch, and the following years brought repeated in-the-wild zero-day fixes. The common thread is that Chrome's attack surface extends well past its own code into the libraries it embeds.
First-order effects
- Chrome users on versions older than 79.0.3945.79 were exposed to remote code execution through SQLite until the update landed; anyone who auto-updated was covered before the flaws were publicly named.
Second-order effects
- Every other vendor that embeds SQLite — browsers, operating systems, and applications — now has to assess whether the same Magellan 2.0 bugs affect their builds and ship their own patches.
Third-order effects
- A repeat engagement by the same research team a year apart signals that widely shared components like SQLite will be probed continuously, pushing the industry toward treating embedded-library patching as a permanent coordination problem between upstream maintainers and downstream embedders.
The trend: Browser security is increasingly determined by vulnerabilities in shared embedded libraries such as SQLite, turning one researcher's findings into a patching obligation across the entire software ecosystem.