It's unlikely any bad guys will be using this to attack Chrome or Edge in the short term.īecause a successful attack would need to be paired with a second exploit, running one of the best Windows 10 antivirus or best Mac antivirus programs will give you a significant amount of protection. So what can you do about this? Not much at the moment, other than to use Firefox or Safari if you're really worried. But if it were to be combined with another attack, perhaps via a separate malware infection, that was able to disable browser sandboxing, then a malicious website could reach out and run programs on your PC without your knowledge.Īnd because Chrome/Chromium flaws are often 'platform agnostic,' there's a good chance this flaw can be exploited on Macs and Linux boxes as well.

This exploit doesn't quite make that illustrious roster. Sandboxing prevents malicious processes in a browser from escaping out into the surrounding operating system, and sandbox 'escapes' are desired achievements in hacking. Stay in your sandbox, kidĪs with the previous 'zero-day,' there's a catch with this one: The targeted browser has to have its sandboxing turned off. The version of Chrome released yesterday patches that flaw. This comes two days after a different Twitter user posted a different Chrome flaw, although he dialed back the 'zero-day' label after it emerged that he'd figured out a hack that had won at the Pwn2Own contest (opens in new tab)last week. Other Chromium-derived desktop browsers, such as Brave, Opera and Vivaldi are also at risk. Tom's Guide can confirm that the proof-of-concept hack does indeed work in a fully patched version of Microsoft Edge, although we weren't able to get it to work in Chrome. This new vulnerability is deemed a 'zero day' flaw because the software developers, in this case the Google staffers and volunteers working on the open-source Chromium project, had 'zero days' to fix it before exploits began to appear 'in the wild.'

Everwing google chrome hack