Google says that it “is aware that an exploit for CVE-2024-4947 exists in the wild.” This means that users must install patches urgently. This particular vulnerability exists in Chromium’s V8 engine.
The update comes hot on the heels of two other zero-days patched in the days prior—the fifth and sixth Chrome zero-days of 2024.
Whenever Chrome gets a security update, other browsers based on the Chromium open-source Web browser project generally require an update, too. Notable browsers built upon the Chromium codebase include Microsoft Edge, Arc, Brave, Vivaldi, Opera, and Opera GX.
None of the aforementioned Chromium-based browsers have been patched as of late Wednesday night, when this article was published. Updates for each are presumably forthcoming within the next few days.
Mac users can update their Chrome, Brave, Edge, or Opera browsers by clicking on the application menu (e.g. “Chrome” or “Microsoft Edge,” next to the Apple logo menu), and then clicking the first item in that menu (e.g. “About Google Chrome” or “About Microsoft Edge”). The browser will check for updates; if an update is available, it will prompt you to restart the app to complete the update.
Arc and Vivaldi for macOS have a slightly different update procedure. After clicking on the Arc or Vivaldi menu (next to the Apple menu), click on “Check for Updates…” to ensure you have the latest version installed.
Windows users can update their browsers by following the steps provided by each browser maker: Chrome, Arc, Brave, Edge, Opera, Vivaldi.
Android users should check the Google Play Store app for the latest versions of their browsers and other apps.
Mobile browsers on iOS and iPadOS use Safari’s WebKit engine, rather than Chromium’s Blink and V8 engines. Therefore, this particular vulnerability does not affect the iOS or iPadOS versions of any Web browsers. If you would like to update your iPhone and iPad browsers anyway, you can do so via the App Store. (Here’s how to manually check for and install updates.)
Starting with iOS 17.4, browser makers may opt into using their own rendering engines. However, this is only available in the EU, for compliance with the Digital Markets Act. No major third-party browsers had brought their own engines to iOS yet, as of when this article is being published.
As we’ve noted in the past, many non-browser apps, including Electron apps, also rely on the Chromium browser codebase for rendering HTML content. These include the desktop versions of apps like 1Password, Discord, Dropbox, Figma, GitHub, Microsoft Teams, Signal, Skype, Slack, Trello, Twitch, WhatsApp, WordPress, and Zoom.
Notably, the Electron framework does not get updated in tandem with Chromium, so some Electron-based apps may remain vulnerable for months. For this and other reasons, it’s important to keep all your other apps updated as well.
To update Mac App Store apps, open the App Store, then click Updates, and click on Update All. Other apps usually have their own separate in-app or external update mechanisms. In some cases, you may need to update an app manually by downloading a new version from the developer’s site.
