The Center for Internet Security says outdated versions of Chrome could let attackers run malicious code just from a visit to a bad webpage, and home users should update now.
Google has released a security update for its Chrome web browser that fixes dozens of vulnerabilities, some of which could let an attacker take over a computer, according to the Center for Internet Security.
The update applies to Chrome versions before 156.0.8078.73/.74 on Windows and Mac, and before 156.0.8078.73 on Linux. Anyone running an older version of Chrome on any of those systems is affected.
The most serious of the flaws could allow “arbitrary code execution,” meaning an attacker could run their own commands on a victim’s computer with the same level of access the logged-in user has, the Center for Internet Security says. Depending on that user’s permissions, an attacker could install programs, view or delete files, or create new accounts with full control of the machine.
According to the advisory, the vulnerabilities could potentially be triggered simply by a user visiting a malicious or compromised webpage, a method sometimes called a “drive-by” attack because no further action from the victim is needed.
The Center for Internet Security says it has no reports so far of these specific flaws being exploited by attackers. The agency rates the risk as medium for government agencies and businesses of all sizes, and low for home users.
Why it matters: Chrome is one of the most widely used browsers, so a flaw that can be triggered just by loading a webpage has broad reach. People who use administrator accounts on their computers, rather than standard accounts with fewer privileges, face a greater potential impact if their browser is compromised, the advisory notes.
What you can do: Update Chrome to the latest version as soon as possible. The Center for Internet Security also recommends running everyday browsing from a standard, non-administrator account rather than one with full administrative rights, which can limit the damage if an attacker does get in.
Based on a release from Center for Internet Security.
