Critical flaw in Google Chrome, CERT-In urges users to update browser

India’s cybersecurity agency, CERT-In, has urged Google Chrome users to update the browser immediately. The agency issued a warning this week over critical vulnerabilities found in Chrome. These flaws could allow a hacker to gain control of your device, with one being actively exploited, as per advisory.CERT-In rated the vulnerabilities “critical” in Vulnerability Note CIVN-2026-0544. The advisory covers Google Chrome versions earlier than 157.0.8103.50 and Chrome Extended Stable versions earlier than 156.0.8078.96. The advisory comes after Google released a security patch on November 9.“Users are strongly advised to apply the latest patches immediately,” CERT-In said.What are the flaws in Google Chrome?The agency said the vulnerabilities included use-after-free flaws in Chrome's XML handling, type confusion in the V8 JavaScript engine, an out-of-bounds write in the GPU component, incorrect authorisation in FileSystem, a buffer overflow in Compositing, and uninitialised resource bugs in WebGL and the GPU. The agency said a hacker could exploit the flaws by persuading a user to visit a specially crafted webpage. Successful exploitation could enable malicious code to run, allow security restrictions to be bypassed or crash the browser. The agency assessed the risk of arbitrary code execution and compromise of affected systems as high.The actively exploited flaw, CVE-2026-125350, is a use-after-free vulnerability, which was reported anonymously on November 6. Google has not disclosed how the attacks work or who is behind them. Users can update Chrome by opening the three-dot menu in the top-right corner, selecting “Help” and then “About Google Chrome.” The browser will check for and download available updates and must be relaunched to complete the installation. On Android or iOS, you can update Chrome via the respective app stores.CERT-In has recommended applying Google's updates immediately. Users have also been advised to avoid suspicious links and unfamiliar websites until their browsers are updated.This advisory comes at a time when cybersecurity threats have skyrocketed. CERT-In also issued a warning for flaws in multiple Android versions. Last month, flaws in PHP, NodeJS, and weak eMudhra security keys shook the internet, with many calling it the Black October. CERT-In has also warned of hackers using AI tools to target systems, with rogue AI agents already accessing sensitive data of some organisations in India.- Ends