03/07/2019
Serious Chrome zero-day – Google says update “right this minute”
06 MAR 2019
36
Google, Google Chrome, Vulnerability
Previous: Google reveals BuggyCow macOS security flaw
Next: Backdoored GitHub accounts spewed secret sneakerbot software
by Paul Ducklin
Chrome users, make sure you’ve got the very latest version.
Or, as Justin Schuh, one of Chrome’s well-known security researchers, put it:
[L]ike, seriously, update your Chrome installs… like right this minute.
We’re not big Chrome fans – we’ve always thought that Firefox is better in both form and function, to be honest – but we have Chrome installed at the moment and can tell you that the version you want is 72.0.3626.121, released at the start of March 2019.
To check that you’re up-to-date, go to the About Google Chrome… window, accessible from the address bar by typing in the special URL chrome://settings/help.
This will not only show the current version but also do an update check at the same time, just in case any recent auto-updates have failed or your computer hasn’t called home yet.
DEEP LEARNING FOR DEEPER CYBERSECURITY
Watch Video
The reason that even the Chrome team are wading in with you’d-better-update warnings is the recent appearance of a zero-day security vulnerability, dubbed CVE-2019-5786, for which Google says it is “aware of of reports that an exploit […] exists in the wild.”
To clarify.
A vulnerability, or vuln for short, is a bug that makes software go wrong in a way that reduces computer security.
An exploit is a way of deliberately triggering a vulnerability to sneak past a security control.