CERT‑In has warned that critical security vulnerabilities affect Google Chrome on Windows, macOS and Linux, and users should update immediately.
The Indian Computer Emergency Response Team (CERT‑In) issued an advisory on Thursday highlighting several high‑severity flaws in the Chrome browser across the three major desktop operating systems. According to the advisory, the vulnerabilities could be exploited to run malicious code, potentially giving attackers access to personal data, browsing history, or even full system control. The agency urges all Chrome users to apply the latest updates without delay.
Key facts
- CERT‑In classified the flaws as critical, the highest severity rating in its risk matrix.
- Affected platforms: Windows 10/11, macOS 12‑13, and major Linux distributions.
- The advisory recommends updating Chrome to the latest version released on the same day as the notice.
- Users are advised to enable automatic updates and review security settings.
- No public exploit code has been reported, but the risk of targeted attacks is considered high.
Why it matters
Chrome holds the largest share of the desktop browser market, handling billions of daily web requests. A breach in the browser can expose everything a user types or views online – from banking credentials to private emails. Because Chrome integrates tightly with the operating system, a successful exploit could also serve as a foothold for further malware installation. For businesses, a compromised browser can become a vector for lateral movement across corporate networks, making the advisory especially relevant for remote workers who rely on Chrome for cloud‑based tools.
Details of the vulnerabilities
CERT‑In’s bulletin does not disclose the exact CVE numbers, but it notes that the flaws involve memory‑corruption bugs and improper handling of web‑content inputs. These types of issues are commonly used to achieve remote code execution (RCE) or privilege escalation. The agency stresses that the bugs are actively being weaponised in the wild, which is why immediate remediation is essential.
| Platform | Recommended action | Impact if unpatched |
|---|---|---|
| Windows | Update Chrome via Settings → About Chrome. Enable “Automatic updates”. | Possible ransomware delivery, data theft. |
| macOS | Use the Chrome menu → About Google Chrome to trigger update. Verify system permissions. | Credential harvesting, session hijacking. |
| Linux | Run sudo apt-get update && sudo apt-get upgrade google-chrome-stable (or distro‑specific command). | Persistent back‑door, privilege escalation. |
Background
CERT‑In is the Indian government’s official body for handling cybersecurity incidents. It routinely publishes advisories when software vendors disclose critical bugs. In the past year, the team has warned about similar issues in popular browsers, office suites, and operating systems. Chrome’s rapid release cycle means new patches are issued roughly every six weeks, but zero‑day exploits can appear between releases, making timely updates a core defense.
What you should do now
- Open Chrome and navigate to
chrome://settings/helpto check the current version. - If an update is available, click “Relaunch” to install it.
- Turn on automatic updates to ensure future patches are applied without manual intervention.
- Review your password hygiene – consider using a password manager and generating strong, unique passwords for each site. See our guide on How to Create a Strong Password You Can Actually Manage.
- Back up important files and enable two‑factor authentication on critical accounts.
What’s next
CERT‑In says it will monitor the situation closely and will release a follow‑up advisory if additional details emerge or if new exploits are observed. Google has confirmed that a patch has been rolled out and is urging users worldwide to apply it. Keep an eye on official Chrome release notes and on future CERT‑In bulletins for any further instructions.
FAQ
Is my current Chrome version safe?
If you are running a version released after the advisory date (typically the version number will be higher than the one listed in the notice), you are protected. Verify via chrome://settings/help.
Can I disable Chrome’s automatic updates?
Disabling automatic updates is possible but strongly discouraged, as it leaves you exposed to known vulnerabilities. If you must manage updates manually, ensure you check for patches at least weekly.
Do these flaws affect mobile Chrome?
The CERT‑In advisory specifically mentions desktop versions on Windows, macOS and Linux. Mobile Chrome on Android and iOS is not listed, but keeping all devices updated remains best practice.
Sources: Moneycontrol.com, Gizbot.
Cover image: Image: Pexels / Pixabay.
