India’s national cybersecurity agency, CERT-In (Computer Emergency Response Team - India), has issued a high-severity warning for users of Google Chrome and Mozilla Firefox, urging them to update their browsers immediately.&nbsp;The alerts, is to warn of multiple security vulnerabilities that could allow hackers to steal personal data, execute remote code, or install malware on affected devices. The vulnerabilities impact users across Windows, macOS, and Linux platforms.&nbsp;<h2>Critical flaws found in Google Chrome</h2>According to CERT-In advisory CIVN-2025-0236, Chrome versions earlier than 141.0.7390.54 for Linux and 141.0.7390.54/55 for Windows and macOS contain several critical flaws.&nbsp;The vulnerabilities, identified as CVE-2025-11205 and CVE-2025-11206, relate to heap buffer overflow bugs in Chrome’s WebGPU and Video components. These issues could allow attackers to run malicious code or crash the browser remotely.&nbsp;Google confirmed that security researcher Atte Kettunen discovered the WebGPU flaw and was awarded a $25,000 bug bounty under its vulnerability rewards programme.&nbsp;Other bugs include side-channel information leaks and memory management errors across Chrome’s Media, Storage, and Tab components.&nbsp;<h2>Firefox users face sandbox and JavaScript engine flaws</h2>CERT-In also released advisory CIVN-2025-0237, warning of critical flaws in Mozilla Firefox versions prior to 143.0.3.&nbsp;The most severe vulnerability, CVE-2025-11152, involves a sandbox escape caused by an integer overflow in Firefox’s Canvas2D graphics engine. This allows attackers to break out of Firefox’s security sandbox and execute code with elevated privileges.&nbsp;Another high-severity issue, CVE-2025-11153, affects Firefox’s JavaScript JIT compiler, potentially enabling remote code execution when users visit malicious websites.&nbsp;Mozilla has since released the Firefox 143.0.3 update, which includes fixes for these vulnerabilities.&nbsp;<h2>CERT-In urges users to update immediately</h2>Both advisories are marked “high severity,” meaning they pose a significant risk to systems if left unpatched.&nbsp;“A remote attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted web page,” CERT-In stated in its advisory.&nbsp;Users are advised to update their browsers immediately to stay protected.&nbsp;Chrome users can go to Settings - Help - About Google Chrome to trigger the update.&nbsp;Firefox users should head to Menu - Help - About Firefox to install the latest version.&nbsp;<h2>Security patches already released</h2>Both Google and Mozilla have issued patches addressing these security threats. Chrome’s latest release, version 141, includes fixes for 21 security issues in total. Mozilla’s Firefox 143.0.3 focuses on resolving the newly identified high-risk vulnerabilities.&nbsp;Cybersecurity experts have emphasised the urgency of updating browsers, warning that unpatched vulnerabilities could serve as gateways for large-scale cyberattacks.&nbsp;According to multiple reports, such browser-based exploits are increasingly being used by attackers to gain access to personal data, financial details, and corporate networks.&nbsp;

India’s cybersecurity agency CERT-In warns users to update Google Chrome and Mozilla Firefox immediately. Critical vulnerabilities could allow hackers to steal data or install malware. Patches are out, but delay in updating may expose your device to serious risks. Here how to update.

India’s national cybersecurity agency, CERT-In (Computer Emergency Response Team - India), has issued a high-severity warning for users of Google Chrome and Mozilla Firefox, urging them to update their browsers immediately. The alerts, is to warn of multiple security vulnerabilities that could allow hackers to steal personal data, execute remote code, or install malware on affected devices. The vulnerabilities impact users across Windows, macOS, and Linux platforms. Critical flaws found in Google Chrome According to CERT-In advisory CIVN-2025-0236, Chrome versions earlier than 141.0.7390.54 for Linux and 141.0.7390.54/55 for Windows and macOS contain several critical flaws. The vulnerabilities, identified as CVE-2025-11205 and CVE-2025-11206, relate to heap buffer overflow bugs in Chrome’s WebGPU and Video components. These issues could allow attackers to run malicious code or crash the browser remotely. Google confirmed that security researcher Atte Kettunen discovered the WebGPU flaw and was awarded a $25,000 bug bounty under its vulnerability rewards programme. Other bugs include side-channel information leaks and memory management errors across Chrome’s Media, Storage, and Tab components. Firefox users face sandbox and JavaScript engine flaws CERT-In also released advisory CIVN-2025-0237, warning of critical flaws in Mozilla Firefox versions prior to 143.0.3. The most severe vulnerability, CVE-2025-11152, involves a sandbox escape caused by an integer overflow in Firefox’s Canvas2D graphics engine. This allows attackers to break out of Firefox’s security sandbox and execute code with elevated privileges. Another high-severity issue, CVE-2025-11153, affects Firefox’s JavaScript JIT compiler, potentially enabling remote code execution when users visit malicious websites. Mozilla has since released the Firefox 143.0.3 update, which includes fixes for these vulnerabilities. CERT-In urges users to update immediately Both advisories are marked “high severity,” meaning they pose a significant risk to systems if left unpatched. “A remote attacker could exploit these vulnerabilities by persuading a victim to visit a specially crafted web page,” CERT-In stated in its advisory. Users are advised to update their browsers immediately to stay protected. Chrome users can go to Settings - Help - About Google Chrome to trigger the update. Firefox users should head to Menu - Help - About Firefox to install the latest version. Security patches already released Both Google and Mozilla have issued patches addressing these security threats. Chrome’s latest release, version 141, includes fixes for 21 security issues in total. Mozilla’s Firefox 143.0.3 focuses on resolving the newly identified high-risk vulnerabilities. Cybersecurity experts have emphasised the urgency of updating browsers, warning that unpatched vulnerabilities could serve as gateways for large-scale cyberattacks. According to multiple reports, such browser-based exploits are increasingly being used by attackers to gain access to personal data, financial details, and corporate networks.

India’s cybersecurity agency CERT-In warns users to update Google Chrome and Mozilla Firefox immediately. Critical vulnerabilities could allow hackers to steal data or install malware. Patches are out, but delay in updating may expose your device to serious risks. Here how to update.

CERT-In warns of flaws in Google Chrome and Mozilla Firefox: Update your browser to avoid serious security risks

The Indian Computer Emergency Response Team (CERT-In), which is part of the Ministry of Electronics and Information Technology, issued a "high-risk" warning for users of Apple's iPhones, MacBooks, iPads, and Vision Pro headsets. The government team has referred to a critical vulnerability that poses a significant security threat.&nbsp;

The overview of the report noted that a Remote Code Execution vulnerability has been reported in Apple Products which could be exploited by a remote attacker to execute arbitrary code on the targetted system.&nbsp;

A range of Apple software and hardware are impacted due to the issue. Apple Safari versions prior to 17.4.1, Apple macOS Ventura versions before 13.6.6, Apple macOS Sonoma versions prior to 14.4.1, Apple visionOS versions before 1.1.1, Apple iOS and iPadOS versions prior to 17.4.1, and Apple iOS and iPadOS versions prior to 16.7.7 are affected.&nbsp;

Also read:&nbsp;<a href="https://www.wionews.com/world/openai-makes-chatgpts-accessible-without-requiring-sign-ups-706819">OpenAI makes ChatGPT's generative AI chatbot accessible without requiring sign ups</a>&nbsp;

Users of iPhone XS, iPad Pro 12.9-inch, iPad Pro 10.5-inch, iPad Pro 11-inch, iPad Air, iPad, and iPad mini are susceptible if their devices are running iOS and iPadOS versions before 17.4.1, the advisory stated.&nbsp;

In addition to that, iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation users are at risk if their devices are not updated to iOS and iPadOS versions 16.7.7 or later.&nbsp;

The advisory mentioned that the vulnerability exists in Apple products because of an "out-of-bound write issue in WebRTC and CoreMedia".&nbsp;

Also read:&nbsp;<a href="https://www.wionews.com/trending/a-grave-step-backwards-meta-to-scrap-misinformation-monitoring-tool-crowdtangle-ahead-of-2024-us-elections-706469">'A grave step backwards': Meta to scrap misinformation monitoring tool CrowdTangle ahead of 2024 US elections</a>&nbsp;

Watch:&nbsp;Meta to shut down misinformation monitoring tool CrowdTangle&nbsp;

<div class="ui-state-default" contenteditable="false">
<div class="twitter-block" draggable="false">
<div class="videoWrapper trancodeVideo"><iframe allowfullscreen="" autoplay="1" class="includeVideo" frameborder="0" height="350" src="https://www.wionews.com/videos/meta-to-shut-down-misinformation-monitoring-tool-crowdtangle-706643/embed" style="width:100%;max-width:560px;" width="560"></iframe></div>
</div>
<a class="close-mark close-div" href="#" id="jqclosemark">×</a></div>

It said that this particular vulnerability could be exploited by a remote attacker by persuading a victim to visit a specially crafted request.&nbsp;

"Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the targetted system," the advisory published on Tuesday (Apr 2) said.&nbsp;

(With inputs from agencies)&nbsp;

The Indian Computer Emergency Response Team (CERT-In), which is part of the Ministry of Electronics and Information Technology, issued a "high-risk" warning for users of Apple's iPhones, MacBooks, iPads, and Vision Pro headsets.

The Indian Computer Emergency Response Team (CERT-In), which is part of the Ministry of Electronics and Information Technology, issued a "high-risk" warning for users of Apple's iPhones, MacBooks, iPads, and Vision Pro headsets. The government team has referred to a critical vulnerability that poses a significant security threat. The overview of the report noted that a Remote Code Execution vulnerability has been reported in Apple Products which could be exploited by a remote attacker to execute arbitrary code on the targetted system. A range of Apple software and hardware are impacted due to the issue. Apple Safari versions prior to 17.4.1, Apple macOS Ventura versions before 13.6.6, Apple macOS Sonoma versions prior to 14.4.1, Apple visionOS versions before 1.1.1, Apple iOS and iPadOS versions prior to 17.4.1, and Apple iOS and iPadOS versions prior to 16.7.7 are affected. Also read: OpenAI makes ChatGPT's generative AI chatbot accessible without requiring sign ups Users of iPhone XS, iPad Pro 12.9-inch, iPad Pro 10.5-inch, iPad Pro 11-inch, iPad Air, iPad, and iPad mini are susceptible if their devices are running iOS and iPadOS versions before 17.4.1, the advisory stated. In addition to that, iPhone 8, iPhone 8 Plus, iPhone X, iPad 5th generation, iPad Pro 9.7-inch, and iPad Pro 12.9-inch 1st generation users are at risk if their devices are not updated to iOS and iPadOS versions 16.7.7 or later. The advisory mentioned that the vulnerability exists in Apple products because of an "out-of-bound write issue in WebRTC and CoreMedia". Also read: 'A grave step backwards': Meta to scrap misinformation monitoring tool CrowdTangle ahead of 2024 US elections Watch: Meta to shut down misinformation monitoring tool CrowdTangle × It said that this particular vulnerability could be exploited by a remote attacker by persuading a victim to visit a specially crafted request. "Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the targetted system," the advisory published on Tuesday (Apr 2) said. (With inputs from agencies)

India issues ‘high-risk’ warning for users of Apple’s iPhones, MacBooks, iPads, Vision Pro headsets

CERT-In has started its probe in the Apple threat notification issue raised by opposition MPs, and a notice has been sent to the company, IT Secretary S Krishnan said on Thursday.

He hoped that Apple would cooperate with the investigation by CERT-In on the issue.

"CERT-In has started its probe... they (Apple) will cooperate in this probe," Krishnan told reporters on the sidelines of an event related to the Meity-NSF research collaboration.

Indian Computer Emergency Response Team or CERT-In is the national nodal agency for responding to computer security incidents as and when they occur.

Asked if a notice has been sent to Apple, the IT Secretary answered in the affirmative.

Several Opposition leaders on October 31 claimed they have received an alert from Apple warning them of "state-sponsored attackers trying to remotely compromise" their iPhones and alleged hacking by the government, a charge IT Minister Ashwini Vaishnaw rejected but assured a thorough probe.

Those who received such notifications included Congress chief Mallikarjun Kharge, party leaders Shashi Tharoor, Pawan Khera, K C Venugopal, Supriya Shrinate, T S Singhdeo and Bhupinder S Hooda; Trinamool Congress MP Mahua Moitra, CPI(M) general secretary Sitaram Yechury and SP chief Akhilesh Yadav.

CERT-In has started its probe in the Apple threat notification issue raised by opposition MPs, and a notice has been sent to the company, IT Secretary S Krishnan said on Thursday.

CERT-In has started its probe in the Apple threat notification issue raised by opposition MPs, and a notice has been sent to the company, IT Secretary S Krishnan said on Thursday. He hoped that Apple would cooperate with the investigation by CERT-In on the issue. "CERT-In has started its probe... they (Apple) will cooperate in this probe," Krishnan told reporters on the sidelines of an event related to the Meity-NSF research collaboration. Indian Computer Emergency Response Team or CERT-In is the national nodal agency for responding to computer security incidents as and when they occur. Asked if a notice has been sent to Apple, the IT Secretary answered in the affirmative. Several Opposition leaders on October 31 claimed they have received an alert from Apple warning them of "state-sponsored attackers trying to remotely compromise" their iPhones and alleged hacking by the government, a charge IT Minister Ashwini Vaishnaw rejected but assured a thorough probe. Those who received such notifications included Congress chief Mallikarjun Kharge, party leaders Shashi Tharoor, Pawan Khera, K C Venugopal, Supriya Shrinate, T S Singhdeo and Bhupinder S Hooda; Trinamool Congress MP Mahua Moitra, CPI(M) general secretary Sitaram Yechury and SP chief Akhilesh Yadav.

Indian officials begin probe into politicians' iPhone hacking attempt alert

ExpressVPN said it is removing Indian-based Virtual Private Network (VPN) servers after the Indian government directed all VPN providers to store user information for at least five years and share it with authorities whenever required.

The company said the "virtual India servers will instead be physically located in Singapore and the UK."

<a href="https://www.wionews.com/world/fbi-probes-fake-emails-sent-from-internal-server-over-possible-cyber-attack-429274">Also Read:&nbsp;FBI probes fake emails sent from internal server over possible cyber-attack</a>

"Under India’s new VPN rule, which is set to come into effect on June 27, 2022, companies will be required to store users' real names, IP addresses assigned to them, usage patterns, and other identifying data," the company informed in a blogpost.

The company informed it has been operating “India (via UK)” server location for several years. Virtual locations are used, where necessary, to provide faster, more reliable connections, it said.

<a href="https://www.wionews.com/videos/pubg-mobile-india-in-trouble-for-sharing-data-with-chinese-servers-393530">Watch:&nbsp;PUBG Mobile India in trouble for sharing data with Chinese servers</a>

The Indian Computer Emergency Response Team (Cert-In) had asked VPN service providers to store information including IP addresses, email IDs of customers and other data for five years and to inform cybersecurity incidents to Cert-In within six hours.

India's minister of state for electronics and information technology Rajeev Chandrasekhar had directed VPN companies to "maintain logs".

"If you are a VPN that wants to hide and be anonymous about those who use VPNs to do business in India and do not want to go by these rules, then frankly pull out of India. That is the only opportunity you have,” India's minister had said.

(With inputs from Agencies)

WATCH WION LIVE HERE

<iframe allow="accelerometer; autoplay; encrypted-media; gyroscope; picture-in-picture" allowfullscreen="" frameborder="0" height="350" src="https://www.wionews.com/live-tv/embed?autoplay=1&amp;mute=1" width="100%"></iframe>

You can now write for wionews.com and be a part of the community. Share your stories and opinions with us <a href="https://www.wionews.com/content-contribution-registration-form">here</a>.

ExpressVPN said it is removing Indian-based Virtual Private Network (VPN) servers after the Indian government directed all VPN providers to store user information for at least five years and share it with authorities whenever required.

ExpressVPN said it is removing Indian-based Virtual Private Network (VPN) servers after the Indian government directed all VPN providers to store user information for at least five years and share it with authorities whenever required. The company said the "virtual India servers will instead be physically located in Singapore and the UK." Also Read: FBI probes fake emails sent from internal server over possible cyber-attack "Under India’s new VPN rule, which is set to come into effect on June 27, 2022, companies will be required to store users' real names, IP addresses assigned to them, usage patterns, and other identifying data," the company informed in a blogpost. The company informed it has been operating “India (via UK)” server location for several years. Virtual locations are used, where necessary, to provide faster, more reliable connections, it said. Watch: PUBG Mobile India in trouble for sharing data with Chinese servers The Indian Computer Emergency Response Team (Cert-In) had asked VPN service providers to store information including IP addresses, email IDs of customers and other data for five years and to inform cybersecurity incidents to Cert-In within six hours. India's minister of state for electronics and information technology Rajeev Chandrasekhar had directed VPN companies to "maintain logs". "If you are a VPN that wants to hide and be anonymous about those who use VPNs to do business in India and do not want to go by these rules, then frankly pull out of India. That is the only opportunity you have,” India's minister had said. (With inputs from Agencies) WATCH WION LIVE HERE You can now write for wionews.com and be a part of the community. Share your stories and opinions with us here.

ExpressVPN to remove servers in India

As the world is moving towards automation and digital world, cybercrimes and threats are also increasing and posing challenges in equal ratio, director-general of Indian Computer Emergency Response Team (CERT-In) Sanjay Bahl said on Thursday.

Bahl was addressing cybersecurity heads, IT employees, police officers from across the country, students and the public at the “Cyber Security Conclave 5.0 the Next Gen Threats and Solutions.”

The conclave was organised by the Society for Cyberabad Security Council (SCSC) in association with Cyberabad police, according to an official press release.

Bahl also presented CERT-Ins priorities that focussed on collecting, analysing and disseminating cyber threat intelligence to benefit all stake-holders who are potentially impacted by these attacks, the release said.

Cyberabad police commissioner V C Sajjanar said nowadays the complaints on cyber crimes are more than the usual crimes.

The complaints are more related to social media, online financial offences and data theft, and the loss due to cyber crimes is immense and poses tough challenges to the police, he said.

SCSC vice-chairman Bharani Kumar Aroll said the digital transformation happening across India is changing the way businesses operate efficiently and effectively and also brings with it risks.

He presented statistics on cyber attacks and also talked about the threat landscape and the promising future of cybersecurity, the release added.

As the world is moving towards automation and digital world, cybercrimes and threats are also increasing and posing challenges in equal ratio, director-general of Indian Computer Emergency Response Team (CERT-In) Sanjay Bahl said on Thursday.

As the world is moving towards automation and digital world, cybercrimes and threats are also increasing and posing challenges in equal ratio, director-general of Indian Computer Emergency Response Team (CERT-In) Sanjay Bahl said on Thursday. Bahl was addressing cybersecurity heads, IT employees, police officers from across the country, students and the public at the “Cyber Security Conclave 5.0 the Next Gen Threats and Solutions.” The conclave was organised by the Society for Cyberabad Security Council (SCSC) in association with Cyberabad police, according to an official press release. Bahl also presented CERT-Ins priorities that focussed on collecting, analysing and disseminating cyber threat intelligence to benefit all stake-holders who are potentially impacted by these attacks, the release said. Cyberabad police commissioner V C Sajjanar said nowadays the complaints on cyber crimes are more than the usual crimes. The complaints are more related to social media, online financial offences and data theft, and the loss due to cyber crimes is immense and poses tough challenges to the police, he said. SCSC vice-chairman Bharani Kumar Aroll said the digital transformation happening across India is changing the way businesses operate efficiently and effectively and also brings with it risks. He presented statistics on cyber attacks and also talked about the threat landscape and the promising future of cybersecurity, the release added.

Cyber crimes, threats loom large as world goes digital: Expert

cert-in

Cert In, News on Cert In, stories on Cert In, articles on Cert In, Cert In stories at Wion, Cert In news, Cert In latest news

cert in

CERT-In warns of flaws in Google Chrome and Mozilla Firefox: Update your browser to avoid serious security risks

India issues ‘high-risk’ warning for users of Apple’s iPhones, MacBooks, iPads, Vision Pro headsets

Indian officials begin probe into politicians' iPhone hacking attempt alert

ExpressVPN to remove servers in India

Cyber crimes, threats loom large as world goes digital: Expert