Image credit: Suzanne Kantra / Techlicious via ChatGPT
Google has released an emergency Chrome update to fix a zero-day security hole that attackers are already using in the wild. Everyone who uses Chrome or a Chrome-based browser should download and install the patch as soon as it is available for your system.
The bug is a high-severity "use-after-free" memory flaw in Chrome's XML component. In plain terms, the browser keeps using a chunk of memory after it has been released, which can let an attacker crash the program or, in some cases, run their own code. An anonymous researcher reported it to Google on November 6, and the patch shipped three days later. According to SecurityWeek, it is the eighth Chrome zero-day exploited this year.
Google hasn't said who is behind the attacks, who was targeted, how the exploit is delivered, or how many people were hit. It also hasn't said how much damage the flaw can do on its own. Google generally holds back bug details until most people have updated, so the picture will likely fill in soon. For now, nothing in the advisory suggests a broad campaign, but there's no reason to wait to find out.
To see if the update has rolled out to you, Open Chrome, click the three-dot menu, then choose Help and About Google Chrome. Chrome will check for the update and download it if it's available. Then relaunch your browser to make sure the patch is in effect.
The fixed versions of Chrome are 157.0.8103.50 or .51 on Windows and Mac and 157.0.8103.50 on Linux.
On Android, Google released Chrome 157.0.8103.50 and says it will reach Google Play over the next few days. The company notes that Android releases include the same security fixes as the matching desktop versions.
Google says the rollout may take days or weeks to complete, so keep checking if you don't see the update yet.
Chrome isn't the only browser affected, because others are built on the same underlying Chromium code. Vivaldi has already released updates for desktop and Android, both dated November 10. At the time of writing, we hadn't confirmed patched releases for Microsoft Edge, Brave, or Opera. If you use one of those, run your browser's built-in update check and install anything it finds.
