Google yesterday (Oct. 28) pushed out an update for Chrome on the desktop that fixes eight security vulnerabilities, including two serious "zero-day" flaws that are already under attack by hackers unnamed.

The update takes Chrome to version 95.0.4638.69 for Windows, Mac, and Linux. Windows and Mac users can usually just relaunch the browser to install the update, while Linux users may have to wait until their distribution bundles the update into its regular update package.

Otherwise, you can force a Chrome update by clicking the three vertical dots at the top right of the browser window, then mousing down and clicking Help. Click "About Google Chrome" in the fly-out menu that appears, and a new tab will either tell you that Chrome is up-to-date or will download the update.

How these Chrome flaws can be exploited

The first of the two zero-day flaws patched involves "insufficient validation of untrusted input in Intents," a protocol whereby Chrome finds the best web app to handle a particular purpose (cataloged as vulnerability CVE-2021-38000). The other allows "inappropriate implementation in V8," Chrome's JavaScript engine (cataloged as vulnerability CVE-2021-38003).

https://g7conet.com/news_single/chrome-fixes-zero-day-flaws-under-hacker-attack