Google has released an urgent software update for its Chrome web browser and is urging Windows, Mac, and Linux users to upgrade the application to the latest available version immediately.

The update started rolling out to users worldwide last week, the Chrome 77.0.3865.90 version contains security patches for 1 critical and 3 high-risk security vulnerabilities, the most severe of which could allow remote hackers to take control of an affected system.

Google has decided to keep details of all four vulnerabilities secret for a few more days in order to prevent hackers from exploiting them and give users enough time to install the Chrome update.

For now, Chrome security team has only revealed that all four vulnerabilities are use-after-free issues in different components of the web browser, the most critical of which could lead to remote code execution attacks.

The use-after-free vulnerability is a class of memory corruption issue that allows corruption or modification of data in the memory, enabling an unprivileged user to escalate privileges on an affected system or software.

Google has paid out a total of $40,000 in rewards to one individual for identifying 2 of the vulnerabilities—$20,000 for CVE-2019-13687 and $20,000 for CVE-2019-13688—while the bug bounties for the remaining two vulnerabilities are yet to be decided.

Successful exploitation of these vulnerabilities could allow an attacker to execute arbitrary code in the context of the browser just by convincing victims into just opening, or redirecting them to, a specially-crafted web-page on the affected Chrome browser, without requiring any further interaction.

Although Google Chrome automatically notifies users about the latest available versions, it’s recommended that all users manually trigger the update process by going to “Help → About Google Chrome” from the menu. After the update is installed, all you’ll need to do is re-launch the browser.

Below are some security steps everyone should take:
1: If you’re a Chrome user, apply the stable channel update provided by Google to vulnerable systems immediately after appropriate testing.
2: Run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack.
3: Remind users not to visit un-trusted websites or follow links provided by unknown or un-trusted sources.
4: Inform and educate users regarding the threats posed by hypertext links contained in emails or attachments especially from un-trusted sources.
5: Apply the Principle of Least Privilege to all systems and services.

Additional information is available below
Forbes.com
https://www.forbes.com/sites/daveywinder/2019/08/29/new-security-warning-issued-for-googles-2-billion-chrome-users/#33f0156d443d

CIS: Center for Internet Security
https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2019-086/