Google has once again closed a security hole in its Chrome browser. It is already the fifth so-called "zero-day" vulnerability this year. In a security advisory, Google announced that this vulnerability is already being exploited.

What exactly happened?

The vulnerability affects version 117.0.5938.132 of Google Chrome and is available for Windows, Mac and Linux. It is a serious security hole caused by a bug in the VP8 codec of the open-source library libvpx. It can lead to anything from app crashes to the execution of arbitrary code.

Who is affected?

The vulnerability, discovered by Google's Threat Analysis Group (TAG), is often exploited in targeted spying attacks. These attacks are usually aimed at people who are classed as particularly high-risk. They include journalists, opposition politicians and activists, but also companies and organisations that manage sensitive data. In this particular case, the vulnerability was used to install spyware. This means that basically anyone who uses Chrome is potentially at risk, but certain groups are more likely to be targeted by attackers because of their work or their activism.

What is Google doing?

Google reacted quickly and released an update. Although it may take a few days or weeks until all users receive the update, it is already available. Chrome also checks for new updates automatically and installs them the next time it starts.

Watch out for spam emails

Be especially careful with emails that ask you to collect a parcel and click a link, especially if the email is sent to an address such as ***@secureit.ch. These could be aimed at exploiting the vulnerability described above.

Conclusion

The repeated incidents with zero-day vulnerabilities in Chrome underline the need to always stay up to date. It is absolutely critical that you update your software regularly, and that applies not only to Google Chrome. Microsoft Edge, which is also based on the Chromium engine, should be kept up to date as well. Updating your browsers is a simple but effective step to protect yourself against potential attacks. This applies to all devices on which you use these browsers - whether PCs, laptops or mobile devices.
Remember that cybercriminals are constantly looking for ways to exploit security holes. A browser that is not up to date is an open door for such attacks. Close this door by making sure that Chrome and Edge are always on the latest version.