{"id":17993,"date":"2021-02-05T13:00:02","date_gmt":"2021-02-05T18:00:02","guid":{"rendered":"https:\/\/me-en.kaspersky.com\/blog\/update-google-chrome-to-8804324150\/17993\/"},"modified":"2022-05-05T11:04:02","modified_gmt":"2022-05-05T07:04:02","slug":"update-google-chrome-to-8804324150","status":"publish","type":"post","link":"https:\/\/me-en.kaspersky.com\/blog\/update-google-chrome-to-8804324150\/17993\/","title":{"rendered":"All users: Update Google Chrome immediately"},"content":{"rendered":"

Researchers have found a critical vulnerability, CVE-2021-21148<\/a>, in Google Chrome. We recommend addressing it as soon as possible because cybercriminals are already exploiting it. Browser versions for major desktop operating systems (Windows, MacOS, and Linux) are all vulnerable. Here\u2019s what\u2019s going on, and how to update your browser.<\/p>\n

Why CVE-2021-21148 is dangerous<\/h2>\n

The vulnerability<\/a> lets cybercriminals perform a heap overflow attack<\/a> \u2014 a manipulation that can lead to remote code execution on a victim\u2019s device. Exploiting the vulnerability can be as simple as crafting a malicious Web page and luring victims to it, but as a potentially devastating result, they can gain total control over the affected system.<\/p>\n

The vulnerable component in this case is the JavaScript V8 engine embedded in the browser. Google received information about the vulnerability on January 24 from security researcher Mattias Buelens, and the company published a patch with the fix on February 4. Google has acknowledged reports of unnamed hackers actively exploiting CVE-2021-21148 in the wild.<\/p>\n

According to a ZDnet article<\/a>, the vulnerability may be connected to recent hacker attacks out of North Korea on the cybersecurity expert community. At least, the attack pattern bears striking similarities to the exploitation of CVE-2021-21148. Also, the date of the vulnerability\u2019s discovery is very close to the date on which the attacks on experts were disclosed. However, we do not yet have direct confirmation of this theory.<\/p>\n

As usual, Google is waiting until most active Chrome users have updated their browsers to disclose more technical details. That is understandable; irresponsible vulnerability disclosure can lead to a rapid increase in attacks.<\/p>\n

How to stay safe<\/h2>\n