The Center for Internet Security is urging Chrome users to update immediately after Google fixed several security flaws, including one already used in attacks.
Google has released a security update for its Chrome web browser to fix multiple vulnerabilities, security weaknesses that attackers could exploit to break into a computer, according to the Center for Internet Security. The organization says one of the flaws is already being used by attackers in the wild.
The update applies to Chrome versions before 157.0.8103.50 (and .51 on Windows and Mac). The Center for Internet Security says the most serious of these flaws could let an attacker run their own malicious code on a victim’s computer simply by getting them to visit a compromised or malicious webpage, a tactic known as a drive-by compromise.
If successful, an attacker could install programs, view or change files, or even create new user accounts, according to the advisory. The damage possible depends on how much access the logged-in user’s account has. Accounts with fewer administrative privileges would see less impact than accounts with full admin rights.
The Center for Internet Security rates the risk as high for large and medium-sized government and business organizations, medium for small governments and businesses, and low for individual home users.
Why it matters: Chrome is one of the most widely used browsers, and this kind of flaw can be triggered just by browsing to the wrong site, no download or click required beyond visiting a page.
What you can do: The Center for Internet Security recommends applying Google’s update as soon as possible after testing it. Everyday users can simply update Chrome through the browser’s built-in update feature, which most versions do automatically, and then restart the browser to complete the install. The advisory also recommends avoiding untrusted websites and links from unknown sources, since drive-by attacks rely on reaching a malicious or compromised page.
Based on a release from Center for Internet Security.
