[rudra]

This is probably old news to many of you. Like 3 days old. But  it might still be relevant to some. Google Chrome needs to be updated to at least version 72.0.3626.121, like right now !
There is a serious zero day vulnerability that's being exploited actively in the wild. It is marked as CVE-2019-5786. It involves bug in FileReader.

If you use auto update, then reopen chrome while online. Else you might open about page in chrome for the version auto check to kick in. You may also manually download a netinstall or full offline install version.

To read more,

https://www.forbes.com/sites/daveywinder...49bd312002


https://mobile.twitter.com/justinschuh/s...6661267456

[Littlemaster]

Thank you for notifying this vulnerability, my chrome is already up-to-date. This vulnerability is dangerous if it is as explained, but why it is only chrome? Other network related softwares may also cause the same issue?
It is better we visit only safe websites.

[Manal]

Thank you very much for informing! When I saw this thread, I ran to check my Google chrome version and thank God, it was 72.0.3626.121 as you mentioned above.

For those who don't know how to check, just enter chrome://version/ in your Google Chrome's URL box and you will get to know.

This looks something very serious! I think my Google Chrome was auto updated.

[rudra]

thanks guys. Now I feel good about having decided to post it, even though it was like 3 days old news.

I hope you guy understand that this is applicable to even your
mobiles.

I always try my best to read all settings and details in softwares and never allow them to run in the background for checking and doing updates automatically. I also keep a firewall that blocks all outgoing as a default and block internet for all softwares that dont need it, even on my mobile. would rather do things manually than letting my computers decide for me if i can.

Thats why I found out about it.

I also use Ungoogled chromium and bromite. Also as a rule, i never open files or execute softwares from within browsers.

[deanhills]

I thought our browsers are always automatically updated.  Like for sure my Firefox is as it always tells me while it's updating my browser.  Chrome is more silent.  Whenever I get the option in setting a browser up I always tick for automatic updates.  Guess I'd better check my Chrome to see whether it is up to date.  

I usually go to the little drop down menu in the top right hand corner where the settings are, then select Help - About Google Chrome. Just checked - it has been automatically updated.

@rudra Are yours on automatic updates too?

[rudra]

@deanhills
I think I do just the opposite ... I dislike auto checking for update, auto update, background service... lol

so i specifically remove and or disable those from places. like service list and startup list and scheduler ...

But yes. Normally , it is meant to auto update. On windows at least.

[Honey]

Thanks for informing! Kinda late to this, but my chrome automatically updated itself to fix the issue, good thing I don't actively use chrome.

[chanalku91]

All software that I use is always updated automatically!
And I thank you for telling me this info

[deanhills]

@deanhills
I think I do just the opposite ... I dislike auto checking for update, auto update, background service... lol

so i specifically remove and or disable those from places. like service list and startup list and scheduler ...

But yes. Normally , it is meant to auto update. On windows at least.

Agreed. One always takes a chance on ticking automatic updates, and I don't do it for all the scripts and software. I stopped it for WordPress after the new Gutenberg Editor came in. Also on Windows when Microsoft tried to force me to load Windows 10 a few years back. My VestaCP is on automatic updates, and I've bitten the bullet at least twice when updates brought my Websites down after Bind went down. But I'd rather have VestaCP updates because of its reputation of security issues, and work with the consequences as collateral damage, than have a hacking incident. Though of course, not having VestaCP at all is probably a more secure option, but I'm very lazy.

[tiwil]

WOW! This problem is really dangerous for users.
I see Chrome's filereader can read our files. I never use auto-update on my PC, since I'm using metered connection, sooo it will take my bandwidth.

Thanks for letting us know about this issue.