Chrome update: CERT-In flags exploited flaw as Google ships 83 more security fixes

India’s national cyber security agency has told Google Chrome users to install the latest Chrome update without delay, after rating a set of flaws in the browser critical. One of them is already being exploited, the Indian Computer Emergency Response Team (CERT-In) said in a vulnerability note issued on Tuesday, 10 November.

The warning covers Chrome versions older than 157.0.8103.50. CERT-In said an attacker working from anywhere could run malicious code, slip past the browser’s security checks or crash the machine, and needs only to get the user to open a rigged web page.

Google’s release notes for that version, dated Monday, 9 November, list nine security fixes. The company said a working attack on one of them, a memory bug in the part of Chrome that reads XML data, was already circulating.

A second, larger patch

Two days later, on Wednesday, 11 November, Google released Chrome 157.0.8103.78 to Windows, Mac and Linux computers. This build closes 83 security holes: five rated critical and 78 rated high. Google did not report any of these being used in attacks, and said computers would receive the build gradually over several days and weeks.

Android phones got the matching version, 157.0.8103.78, on the same day carrying identical security fixes, and Google said it would appear on Google Play within a few days. Computers on Chrome’s Extended Stable channel need version 156.0.8078.100, which carries 72 security fixes.

What you need to do

On a computer, open Chrome, click the three-dot menu in the top-right corner, then choose Help and About Google Chrome. The browser looks for the new version by itself; click Relaunch when the button shows up. Google’s help page says that if there is no Relaunch button, the browser is already current. Open tabs return after the restart, though Incognito windows are lost.

The number on that page should read 157.0.8103.50 or higher to close the flaw under attack, and 157.0.8103.78 or higher for the later batch. On Android, launch Google Play, tap the profile icon, go to Manage apps & device and tap Update beside Chrome. Inside the browser, Settings and then About Chrome shows the installed version. Chrome on Android needs Android 10 or later.

The next version is already moving. On Thursday, 12 November, Google began sending Chrome 158 to a small share of Windows and Android users, with Mac to follow. iPhone users can already download Chrome 158.0.8127.35 from the App Store.