Google is warning users of a high-severity vulnerability in its Chrome browser that is currently being exploited by attackers to hijack computers.

The flaw (CVE-2019-13720), discovered by security researchers Anton Ivanov and Alexey Kulaev at Kaspersky, exists in Google Chrome’s audio component. Google is urging users to update to the latest version of Chrome, 78.0.3904.87 (for Windows, Mac, and Linux) as it rolls out over the coming days.

“This [updated] version addresses vulnerabilities that an attacker could exploit to take control of an affected system,” according to a Thursday Cybersecurity and Infrastructure Security Agency (CISA) alert. “One of these vulnerabilities (CVE-2019-13720) was detected in exploits in the wild.”

The bug (CVE-2019-13720) is a use-after-free flaw, which is a memory corruption flaw where an attempt is made to access memory after it has been freed. This can cause an array of malicious impacts, from causing a program to crash, to potentially leading to execution of arbitrary code – or even enable full remote code execution capabilities.

Costin Raiu, director of Global Research and Analysis Team at Kaspersky, wrote on Twitter “a few days ago our technologies caught a new Chrome 0day exploit used in the wild and we reported it to Google.”

A few days ago our technologies caught a new Chrome 0day exploit used in the wild and we reported it to Google. Just released-Chrome 78 patches it, credits to my colleagues @antonivanovm and Alexey Kulaev for finding the bug. https://t.co/Bgm0QtNO2d

— Costin Raiu (@craiu) November 1, 2019

However, further information about the exploits are scant. Threatpost has reached out to Kaspersky for further details about the exploits and the vulnerability.

Google and researchers remain tight lipped intentionally. “Access to bug details and links may be kept restricted until a majority of users are updated with a fix,” according to Google’s alert. “We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven’t yet fixed,” Google said in its advisory.

Use-after-free flaws have plagued Google’s Chrome browser as of recent. In August, Google disclosed a high-severity use-after-free vulnerability (CVE-2019-5869) in Blink, an open-source browser engine that powers the Google Chrome browser, that could enable remote attackers to execute code and carry out other malicious attacks.

Google on Thursday also disclosed another high-severity vulnerability (CVE-2019-13721) in PDFium, which was developed by Foxit and Google and provides developers with capabilities to leverage an open-source software library for viewing, and searching PDF documents.

This flaw is also a use-after-free vulnerability but there are no reports of it being exploited in the wild. It was disclosed by a researcher under the alias “banananapenguin” who received a $7500 bounty through Google’s vulnerability disclosure program for the discovery.

What are the top mistakes leading to data breaches at modern enterprises? Find out: Join experts from SpyCloud and Threatpost senior editor Tara Seals on our upcoming free Threatpost webinar, “Trends in Fortune 1000 Breach Exposure.” Click here to register.