Google ships Friday Chrome fix for actively exploited zero day, urges immediate updates
Marcus Webb ·
Google released a Chrome Stable Channel security update on Friday that fixes a zero day the company says is being exploited in the wild. The patch is rolling out for Windows, macOS, and Linux, and Google is urging users and administrators to update before going offline for the weekend.
The vendor assigned a CVE to the flaw and rated it a high severity issue. In line with its disclosure policy, Google is withholding technical details and bug links until a majority of users receive the update, a step that limits copycat exploitation.
What Google says
The update addresses at least one memory safety issue that allows code execution or sandbox escape, a class of bug that has accounted for many of Chrome’s recent in the wild exploits. Google did not publish a version number threshold in the advisory as of publication, but the fixed build is available via the built in updater under Help and About Google Chrome.
Chrome for Android typically follows within hours or days. Chromium based browsers including Microsoft Edge, Brave, and Vivaldi will issue their own releases that incorporate the upstream fix, and enterprises using those products should track respective advisories.
What security teams should do
Administrators should push the latest Chrome Stable build today using enterprise management tools, then enforce a browser relaunch to load the patched binaries. Teams should enable or verify automatic updates, and where possible restrict outdated versions from executing through application control policies.
Given active exploitation, defenders should increase monitoring for unusual Chrome child processes, unexpected command line flags, and interprocess communications to non browser components. CISA often adds actively exploited browser CVEs to its Known Exploited Vulnerabilities catalog, so agencies and contractors should watch for a binding operational directive with remediation deadlines.
This Friday drop underscores the ongoing pressure on client side patching. Attackers continue to target browsers as initial access points, and vendors are shipping fixes quickly, which pushes enterprises to treat browser updates with the same urgency they reserve for operating system and VPN flaws.