Two weeks after patching an actively-exploited vulnerability affecting Chrome for desktop, Google is squashing another zero-day bug in the browser’s version for Windows, macOS, and Linux, as well as pushing out an update for Chrome for Android that plugs yet another security loophole that is being exploited in the wild.

Today Chrome fixed two more vulnerabilities that were being actively exploited in the wild (discovered by Project Zero/Google TAG last week). CVE-2020-16009 is a v8 bug used for remote code execution, CVE-2020-16010 is a Chrome sandbox escape for Android. https://t.co/IOhFwT0Wx1

— Ben Hawkes (@benhawkes) November 2, 2020

“Google is aware of reports that an exploit for CVE-2020-16009 exists in the wild,” said the tech giant about the newly-disclosed flaw that stems from an inappropriate implementation in the V8 JavaScript engine and impacts the browser’s desktop versions.

The bug, classified as high-severity, was discovered by researchers from Google’s Threat Analysis Group and Project Zero. Details about the vulnerability are very sparse due to Google’s policy that clearly states that “access to bug details and links may be kept restricted until a majority of users are updated with a fix.”

Per the National Vulnerability Database, the flaw “could allow an attacker to potentially exploit heap corruption via a crafted HTML page.”

RELATED READING: Security terms explained: What does Zero Day mean?

Users would do well to update their browsers to the latest version (86.0.4240.183) as soon as possible. If you have automatic updates enabled, your browser should update by itself. Otherwise you’ll have to do it manually by navigating to the About Google Chrome section, which can be found under Help in the side menu.

The update also brings fixes for a total of 10 vulnerabilities, with Google specifically listing seven high-risk flaws where the fixes were contributed by external…