SQLite flaws left Chrome open to remote code execution before being patched two weeks ago, were found by Tencent researchers a year after revealing similar bugs
Magellan 2. is some vulnerabilities that exist … Guenni / Born's Tech and Windows World : Google Chrome/SQLite: New Magellan 2.0 vulnerabilities Tweets: @tencent_blade : No need to worry: SQLite and Google have already confirmed and fixed it and we are helping other vendors through it too. We haven't found any proof of wild abuse of Magellan 2.0 and will not disclose any details now. Feel free to contact us if you had any technical questions! https://twitter.com/... @tencent_blade : Magellan 2.0 on its way! Blade researcher @leonwxqian found another set of vulnerabilities in #SQLite which can result in remote code execution via WebSQL, leaking program memory or possible program crashes. More Q&As can be found at https://blade.tencent.com/... Catalin Cimpanu / @campuscodi : Google Chrome impacted by new Magellan 2.0 vulnerabilities * Fixed in Chrome 79.0.3945.79 * Magellan 2.0 actually impacts SQLite * Many apps also impacted, but likely not exploitable * However, Chrome is susceptible to “remote” attacks... because WebSQL https://www.zdnet.com/... https://twitter.com/...
Context & Ripple Effects
Tencent's Blade team is back with Magellan 2.0, a second round of SQLite vulnerabilities disclosed roughly a year after the original Magellan bugs — this time enabling remote code execution in Google Chrome through the WebSQL interface. Google shipped the fix in Chrome 79.0.3945.79 about two weeks before disclosure, and Tencent says it found no proof of abuse in the wild and is withholding technical details while helping other vendors through the patch process.
The disclosure fits a pattern the related coverage has tracked all year: in March, Google revealed a Chrome patch was actually a fix for an actively used sandbox-escaping zero-day. Magellan 2.0 is different in kind — not a Chrome bug but a flaw in a component Chrome embeds, which means the blast radius extends to every vendor shipping SQLite.
First-order effects
- Chrome users were exposed to remote code execution via WebSQL until the Chrome 79.0.3945.79 update landed; the fix has been out for two weeks, so unpatched installs are the immediate risk pool.
- Tencent is privately walking other SQLite-embedding vendors through the fixes while sitting on technical details, so vendors beyond Google are patching on a delayed, coordinated-disclosure clock.
Second-order effects
- Every browser, OS, and application that bundles SQLite — not just Chrome — must audit and patch against the same bug class, turning a Google security update into a fleet-wide vendor chore.
- With details withheld and no observed abuse, defenders get no signatures or exploit intelligence, shifting the burden to proactive patching rather than detection.
Third-order effects
- Shared low-level components like SQLite are becoming cross-industry single points of failure: one researcher team's find forces simultaneous patching across browsers, operating systems, and apps — a structural argument for the kind of ecosystem-wide defense coordination the related coverage keeps circling.
- If the Magellan pattern holds — repeat finds in the same component a year apart — component-level fuzzing and disclosure become a recurring beat in browser security, alongside the in-the-wild Chrome zero-day fixes Google has repeatedly had to rush out.
The trend: Browser security is increasingly decided in the shared components beneath the browser, where a single SQLite flaw becomes a coordinated patching event across the entire software ecosystem.