India's cyber security agency has advised Google Chrome users to update their browsers immediately, warning of multiple critical security vulnerabilities, which could let attackers take control of their device.

One of the reported vulnerabilities is already being actively exploited in real attacks, the agency said.

The Indian Computer Emergency Response Team (CERT-In) published the advisory, Vulnerability Note CIVN-2026-0544, on November 10, 2026 and rated it "critical".

The note covers Chrome versions older than 157.0.8103.50, as well as Chrome Extended Stable versions older than 156.0.8078.96. It lists several separate weaknesses across the browser. They include a use-after-free fault in its XML handling, type confusion in the V8 JavaScript engine, and out-of-bounds memory writes in the GPU component. The agency also names incorrect authorisation in the FileSystem component, a buffer overflow in Compositing, and uninitialised resource bugs in WebGL and the GPU.

According to CERT-In, an attacker would only need to persuade a victim to open a specially crafted webpage. A successful attack could allow arbitrary code to run on the machine, get around the browser's security restrictions, or trigger a denial-of-service condition. The agency describes the risk of code execution and system compromise as high.

The advisory singles out one flaw, tracked as CVE-2026-125350, as being actively exploited in the wild. For that reason, CERT-In says users should apply the latest patches without delay. Its recommended fix is to install the updates released by Google.

Updating takes a few moments. Users have to open Chrome, click the three-dot menu at the top right, go to Help, and choose 'About Google Chrome'.

Source link