Update Google Chrome Now to Patch This Serious Flaw

Chrome browser on desktop displaying Chrome logo.
(Image credit: Footage Vector Photo/Shutterstock)

If you use the Google Chrome browser (and you probably do), it's time to update if you can. 

An emergency patch has been pushed out to Windows, macOS and Linux users to fix a serious vulnerability that could permit full system takeover by a malicious website. Android and iOS are not affected.

"Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code in the context of the browser," wrote the non-profit Center for Internet Security in an advisory Tuesday (Aug. 27). "Depending on the privileges associated with the application, an attacker could install programs; view, change, or delete data; or create new accounts with full user rights."

Chrome version 76.0.3809.132 patches this flaw and two others for which we have fewer details, although the update is being rolled out in stages, so you might not be able to install it yet. (The vulnerability has not yet been exploited in the wild.)

MORE: 15 Best Google Chrome Privacy Extensions

How to update Chrome

To check to see if you're up to date or whether an update is available for your machine, click the three vertical dots in the upper right corner of the browser window, scroll down to and hover your mouse cursor over "Help", then click "About Google Chrome" in the fly-out dialogue box. 

Alternatively, you can just paste "chrome://settings/help" into the address bar.

A new webpage will open stating the version of Chrome you're on. In most cases, if an update is available for your machine, the update process will begin automatically and you'll only have to restart the browser. Some Linux users may have to wait for the update to come as part of their Linux distribution's official update process.

Because the flaw is in Blink, the open-source rendering engine that puts webpages together in your browser, it is likely that other browsers that use Chromium, the open-source underpinnings of Chrome, will also be affected. Those browsers include Brave, Opera, Vivaldi and the beta version of Microsoft's Edge, although we've not yet seen advisories from them about this flaw.

The Center for Internet Security's advisory noted that the malicious impact would be minimized if the affected user account did not possess administrative rights. Tom's Guide has long advised Windows users to create limited-privilege accounts, without the ability to modify programs, for daily use, as this often limits how much damage malware can do.

The flaw was reported to Google by Zhe Jin and Luyao Liu of Chinese antivirus maker Qihoo 360, and the researchers collected $5,500 as a bug bounty for their efforts.

Paul Wagenseil

Paul Wagenseil is a senior editor at Tom's Guide focused on security and privacy. He has also been a dishwasher, fry cook, long-haul driver, code monkey and video editor. He's been rooting around in the information-security space for more than 15 years at FoxNews.com, SecurityNewsDaily, TechNewsDaily and Tom's Guide, has presented talks at the ShmooCon, DerbyCon and BSides Las Vegas hacker conferences, shown up in random TV news spots and even moderated a panel discussion at the CEDIA home-technology conference. You can follow his rants on Twitter at @snd_wagenseil.