Chrome under attack for second time this month — here's what to do
How to patch your browser to stay safe
Heads up, kids — Google has released its second emergency update for Chrome this month.
Chrome version 89.0.4389.90 for Windows, Mac and Linux fixes five security bugs, one of which (catalogued as CVE-2021-21193) has to do with unprotected memory in Chrome's Blink rendering engine.
"Google," the official Chrome blog post dryly notes, "is aware of reports that an exploit for CVE-2021-21193 exists in the wild."
- Microsoft Edge just got a killer upgrade Chrome can’t match
- Chrome vs. Firefox vs. Edge: Which browser gobbles up the most RAM?
- Plus: Google is fixing the most annoying thing about Gmail
In other words, the bad guys knew about this Blink vulnerability and launched attacks before the good guys could get their boots on — the classic definition of a zero-day exploit. The flaw was reported to Google three days ago by a researcher who apparently wishes to remain anonymous.
How to update Chrome
Bringing your Chrome browser up-to-date is easy on Windows and Macs. Closing and relaunching the browser usually does the trick.
Otherwise, click the three vertical dots at the top right of the Chrome browser window with your mouse cursor, scroll down to Help and click About Google Chrome in the fly-out window.
A new browser tab will open; it will either tell you that "Google Chrome is up to date" or download the latest version and prompt you to relaunch the browser. Again, you want to be on version 89.0.4389.90.
Sign up now to get the best Black Friday deals!
Discover the hottest deals, best product picks and the latest tech news from our experts at Tom’s Guide.
On Linux, you'll probably have to wait for your distribution to put the Chrome update in the distribution's regular software update cycle.
Four other fixes
Two of the other four flaws in today's patches were reported by non-Google parties. One is a memory-handling flaw in WebRTC, the multimedia engine built into modern web browsers; its pseudonymous finder, "raven," will get a $500 bug bounty for their troubles.
The other is a heap buffer overflow — basically a memory overrun — in Chrome tab groups, which was found by Abdulrahman Alqabandi of the Microsoft Browser Vulnerability Research team.
Google discovered and fixed two other flaws on its own and isn't providing any details about those yet.
On March 2, Google patched 47 Chrome security flaws, including an audio flaw that was already being exploited in the wild.
Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.