Hackers attacking Google Chrome — what to do now

News
By last updated

Steps to take to stay safe online

Google Chrome update
(Image credit: Shutterstock)

Update: Google issues urgent security fix for Chrome — update right now.

Google last night (Dec. 13) patched the desktop version of the Chrome browser to fix five security flaws, including one high-risk "zero-day" vulnerability that's likely already being exploited "in the wild" by attackers. Updates may not reach all users right away.

To make sure your Chrome installation is up to date, click the three vertical dots on the top right of the browser window. Mouse down and hover your cursor to Help, then click About Google Chrome. 

A new tab will open that either shows you that your version is up-to-date, or will begin a download of the new version if you're on Windows or Mac. If the latter happens, you'll just need to relaunch the browser.

Loss of memory

The vulnerability that's already being exploited involves a "use after free" bug in V8, Chrome's JavaScript engine, according to the official Chrome Releases blog post. 

"Use after free" implies that some process in V8 is not properly "returning" its block of allocated memory space to Chrome's central repository, creating an opportunity for a malicious process to seize the memory block and hack Chrome from the inside. The discovery of the flaw was credited to an anonymous researcher.

The other four flaws involved Chrome graphics rendering and software libraries. Although those flaws weren't publicly disclosed before yesterday, it's likely that some attackers will try to figure out what the problems are and craft exploits accordingly. Google won't reveal the details of each one for another 30 days.

Google this year has patched at least a dozen flaws in Chrome that counted as "zero days", meaning the flaws were publicly known of and likely exploited before Google had a chance to patch them. 

Paul Wagenseil
Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.