Update Google Chrome ASAP to Patch 2 New Actively Exploited Zero-Day Flaws

Google on Thursday pushed urgent security fixes for its Chrome
browser, including a pair of new security weaknesses that the
company said are being exploited in the wild, making them the
fourth and fifth actively zero-days plugged this month alone.

The issues, designated as CVE-2021-37975 and CVE-2021-37976^[1], are part of a total of
four patches, and concern a use-after-free flaw^[2]
in V8 JavaScript and WebAssembly engine as well as an information
leak in core.

As is usually the case, the tech giant has refrained from
sharing any additional details regarding how these zero-day
vulnerabilities were used in attacks until a majority of users are
updated with the patches, but noted that it’s aware that “exploits
for CVE-2021-37975 and CVE-2021-37976 exist in the wild.”

An anonymous researcher has been credited with reporting
CVE-2021-37975. The discovery of CVE-2021-37976, on the other hand,
involves Clément Lecigne from Google Threat Analysis Group, who was
also credited with CVE-2021-37973^[3], another actively
exploited use-after-free vulnerability in Chrome’s Portals API that
was reported last week, raising the possibility that the two flaws
may have been stringed together as part of an exploit chain to
execute arbitrary code.

With the latest update, Google has addressed a record 14
zero-days in the web browser since the start of the year.

Chrome users are advised to update to the latest version
(94.0.4606.71) for Windows, Mac, and Linux by heading to Settings
> Help > ‘About Google Chrome’ to mitigate any potential risk
of active exploitation.