Time to update Chrome. Google has learned that hackers are exploiting two severe vulnerabilities in the browser to take over computers.
On Wednesday, the company released a patch for the previously unknown vulnerabilities, which it uncovered with the help of an anonymous tip. According to Google, exploits for both flaws “exist in the wild,” meaning hackers have developed the means to weaponize them.
The first flaw, CVE-2020-16013, involves a problem with Chrome’s V8 Javascript engine, which is designed to execute computer code over the browser. The second flaw, CVE-2020-16017, involves undermining a Chrome security feature known as site isolation, which can prevent a website opened in a browser tab from interacting with another tab.
Not much else is known about the flaws, such as who might be exploiting them. But US cyber authorities are indicating that either vulnerability can pave the way for a hacker to remotely take control of a victim’s computer.
“These vulnerabilities can be exploited if a user visits, or is redirected to, a specially crafted web page,” wrote the Center for Internet Security in a warning. “Depending on the privileges associated with the application, an attacker could view, change, or delete data.”
The Center for Internet Security adds the risk of exploitation is especially high for people who work in the government or the corporate sector. However, the danger is low for average consumers, which suggests the hackers have been going after select targets.
Google’s patch can be download as an update to Chrome known as “version 86.0.4240.198” for Windows, Mac, and Linux. The browser should receive the update automatically, but you can also manually install the patch. On desktop, this can be done by going to the three-dot icon in the top-right corner and selecting Help > About Google Chrome.
The patch arrives after Google fixed three other previously unknown flaws in Chrome in the past month—all of which hackers were also actively exploiting. Whether the attacks are all connected remains unclear at this point.
