CERT-In warns Chrome users of critical security flaws
What's the story
The Indian Computer Emergency Response Team (CERT-In) has issued a critical-severity security warning for desktop users of Google Chrome. The advisory highlights multiple vulnerabilities that could be exploited by attackers to execute arbitrary code, steal sensitive data, and bypass security restrictions. The flaws affect versions of Chrome prior to 156.0.8078.47/.48 on Windows and Mac systems, and versions prior to 156.0.8078.47 on Linux platforms.
Update recommendation
Update to non-affected version of Chrome
CERT-In has recommended organizations and individuals using the affected versions of Chrome to check Google's security updates.
These updates provide details about the vulnerabilities, the components they affect, and potential fixes.
The agency stressed that updating to a non-affected version is crucial for safeguarding against these critical security risks in Google Chrome.
Vulnerability details
Vulnerabilities could be exploited via a specially crafted web request
The vulnerabilities in question stem from several security issues, including use-after-free errors, memory corruption, improper input validation, out-of-bounds read and write operations.
They also include type confusion, range errors, improper access control, missing authorization, and information leaks.
An attacker could exploit these flaws by tricking a user into opening a specially crafted web request.
Exploitation consequences
Exploitation could lead to system compromise, data theft
If successfully exploited, these vulnerabilities could allow a remote attacker to execute arbitrary code on the targeted system, steal sensitive information, bypass security restrictions, or even trigger a denial-of-service (DoS) condition.
This could lead to unauthorized data access, system compromise, and service disruption.
CERT-In has rated the overall severity of these vulnerabilities as critical due to their potential impact on users' systems and data security.
User guidance
How to update Chrome on your desktop?
To protect their systems, users are advised to check their installed version of Chrome and update it to a non-affected one.
Windows and Mac users should ensure they are running version 156.0.8078.47 or later, while Linux users should update to version 156.0.8078.47 or later.
This can be done by opening Google Chrome, clicking on the three-dot menu in the top-right corner, and navigating to Help > About Google Chrome for available updates and installation instructions.