Update: Google issues urgent security fix for Chrome — update right now.
Google last night (Dec. 13) patched the desktop version of the Chrome browser to fix five security flaws, including one high-risk "zero-day" vulnerability that's likely already being exploited "in the wild" by attackers. Updates may not reach all users right away.
The new updates take the current version of Chrome on Windows, Mac and Linux to version 96.0.4664.110. Windows and Mac users generally need to only close and relaunch the browser to start the update; Linux users may need to wait for their distributions to bundle the patch into regular update cycles. (Android and iOS versions of Chrome get separate updates.)
To make sure your Chrome installation is up to date, click the three vertical dots on the top right of the browser window. Mouse down and hover your cursor to Help, then click About Google Chrome.
A new tab will open that either shows you that your version is up-to-date, or will begin a download of the new version if you're on Windows or Mac. If the latter happens, you'll just need to relaunch the browser.
Some other widely used browsers that share Chrome's open-source underpinnings, including Microsoft Edge, Brave, Opera and Vivaldi, have not yet been updated to the new version. Microsoft may be waiting until its own December Patch Tuesday round of updates are pushed out later today (Dec. 14).
Loss of memory
The vulnerability that's already being exploited involves a "use after free" bug in V8, Chrome's JavaScript engine, according to the official Chrome Releases blog post.
"Use after free" implies that some process in V8 is not properly "returning" its block of allocated memory space to Chrome's central repository, creating an opportunity for a malicious process to seize the memory block and hack Chrome from the inside. The discovery of the flaw was credited to an anonymous researcher.
The other four flaws involved Chrome graphics rendering and software libraries. Although those flaws weren't publicly disclosed before yesterday, it's likely that some attackers will try to figure out what the problems are and craft exploits accordingly. Google won't reveal the details of each one for another 30 days.
Google this year has patched at least a dozen flaws in Chrome that counted as "zero days", meaning the flaws were publicly known of and likely exploited before Google had a chance to patch them.
