Browser zero-days: update, then restart
Chrome fixed a font-library bug already used in attacks. The update only works after the browser restarts.
Last week Google released an urgent Chrome update for CVE-2020-15999, a bug in the FreeType font library that attackers were already exploiting. A web page with a malicious font could run code on your computer.
Chrome downloads updates by itself. But it only applies them when the browser restarts, and many people leave it open for weeks.
- Check now: Settings, About Chrome. If it says “Relaunch”, do it.
- For companies: set a policy that forces a relaunch within a few days of an update.
- Don’t forget other browsers built on Chromium, like Edge, Brave and Opera, and apps that embed it.
The browser is the most attacked program on most computers. Its update is the one not to postpone.