Google has released an emergency patch to fix seven flaws, two of them being zero-day vulnerabilities that have been actively exploited in-the-wild. Currently, the patch only mitigates the issues on the desktop version of Google Chrome. The details of the attacks have not yet been disclosed and will become public once Google is able to patch the issues on mobile device versions of Chrome as well. The first zero-day vulnerability, tracked as CVE-2021-38000, is an insufficient validation of untrusted input in intents flaw, which if exploited could allow an attacker to craft a malicious input in a form that is not expected by the rest of the application, leading to arbitrary code execution. The second zero-day flaw, tracked as CVE-2021-38003, is described as an inappropriate implementation vulnerability within the Chrome V8 JavaScript engine, which if exploited would allow an unauthenticated attacker to be able to execute arbitrary code remotely. Users of the Chrome desktop version are urged to immediately update to the latest patch. At this time, there are no details about exactly what data was compromised, and what the threat actor’s intentions are, and the Ankura CTAPT will provide an update when the information is disclosed to the public.