Google has once again closed a security gap in its Chrome browser. It is already the fifth so-called "zero-day" vulnerability this year. In a security advisory, Google announced that this vulnerability is already being exploited.

What exactly happened?

The vulnerability affects version 117.0.5938.132 of Google Chrome and is available for Windows, Mac and Linux. It is a serious security gap caused by a bug in the VP8 codec of the open-source library libvpx. This can lead to anything from app crashes to the execution of arbitrary code.

Who is affected?

The vulnerability, discovered by Google's Threat Analysis Group (TAG), is often exploited in targeted espionage attacks. These attacks are usually directed at people classified as particularly high-risk. These include journalists, opposition politicians and activists, but also companies and organisations that manage sensitive data. In this particular case, the vulnerability was used to install spyware. This means that basically anyone using Chrome is potentially at risk, but certain groups are more likely to be targeted by attackers because of their work or their engagement.

What is Google doing?

Google reacted quickly and released an update. Although it may take a few days or weeks for all users to receive the update, it is already available. Chrome will also automatically check for new updates and install them after the next restart.

Beware of spam e-mails

Be particularly careful with e-mails asking you to collect a parcel and click a link, especially if the e-mail is sent to an address such as ***@secureit.ch. These could be aimed at exploiting the vulnerability mentioned.

Conclusion

The repeated incidents with zero-day vulnerabilities in Chrome underline the need to always stay up to date. It is absolutely critical that you update your software regularly, and this does not only apply to Google Chrome. Microsoft Edge, which is also based on the Chromium engine, should also be kept up to date. Updating your browsers is a simple but effective step to protect yourself against potential attacks. This applies to all devices on which you use these browsers - whether PCs, laptops or mobile devices.
Remember that cybercriminals are constantly looking for ways to exploit security gaps. A browser that has not been updated is an open door for such attacks. Close this door by making sure that Chrome and Edge are always on the latest version.