CERT-In issues high-risk security warning for Google Chrome, Android users

CERT-In has flagged critical vulnerabilities affecting Google Chrome on desktop and Android 13-15, urging users to update immediately to avoid potential remote attacks and data breaches

The Indian Computer Emergency Response Team (CERT-In) has issued an advisory for users of the Google Chrome browser on Windows PC, Macs, and Linux devices, as well as for smartphones running on older Android versions. The advisory highlights security flaws within these platforms stating that they can be exploited by an attacker.

CERT-In advisory for Google Chrome

Affected software:

• Google Chrome versions prior to 137.0.7151.55 for Linux
• Google Chrome versions prior to 137.0.7151.55/56 for Windows and Mac

Nature of the threat:

CERT-In has classified these vulnerabilities as "High risk," warning that they could potentially allow remote attackers to execute arbitrary code and cause denial of service on targeted systems. The advisory stated that these vulnerabilities could affect both individual and organisational users. 

  CERT-In advisory stated that the vulnerabilities stem from various issues such as inappropriate implementation of Background Fetch API, FileSystemAccess API and more. It stated that a remote attacker could potentially exploit these vulnerabilities by persuading a victim to visit a specially crafted web page.

Solution:

CERT-In strongly advises all users to update Google Chrome to the latest version immediately. The official fix is available through Chrome’s stable channel update.

CERT-In advisory for Android

Affected software:

• Android 13
• Android 14
• Android 15

Nature of the threat:

CERT-In has classified these vulnerabilities as "High risk," warning that they could potentially allow attackers to gain unauthorised access to sensitive user data, gain elevated privileges, and cause denial of service on targeted systems. These vulnerabilities exist on smartphones from all OEMs running on the affected software version. 

  CERT-In advisory stated that the vulnerabilities exist in Android due to flaws in the Framework, Android Runtime, System, Google Play, Arm Components, Imagination Technologies and Qualcomm Components.

Solution:

CERT-In strongly advises all users to update their smartphones to appropriate software versions when made available by respective OEMs.