Windows Security · Patch Tuesday & Vulnerabilities · Lesson 3 of 5

Browsers and Apps Need Patches Too

Windows Update doesn't cover everything. Patch the rest, or remove it.

Your browser patches itself

Windows Update fixes Windows. It does not fix every program on your PC.

Your browser, the app you use to visit websites, is the program most exposed to attack. It reads content from any site you open, including bad ones. So browser makers ship security fixes often, sometimes more than once a week.

The good news is that Microsoft Edge, Google Chrome and Firefox update themselves. They download fixes in the background. The catch: a fix isn't active until the browser restarts. Many people leave a browser open for weeks, so the fix just sits there.

To check for an update and finish it:

• Edge: open the menu (three dots), then Settings, then About Microsoft Edge.
• Chrome: open the menu (three dots), then Help, then About Google Chrome.
• Firefox: open the menu (three lines), then Help, then About Firefox.

The About page checks for updates right away. If one is waiting, you will see a Restart or Relaunch button. Your open tabs normally come back afterward.

When a browser maker fixes a zero-day, the news often says "update Chrome now" or similar. Opening the About page and restarting is all you need to do. You don't need to download anything from a website. A pop-up that says your browser is out of date and offers a download is a common trick, so ignore it.

Extensions are small add-ons inside the browser. They update through the browser's own store. Remove any you don't use. Each one is extra code, and some get sold to new owners who add bad features.

Apps that hide old holes

Other apps need patches too. Attackers like programs that open files from strangers or stay online all the time, such as:

• PDF readers, apps that open PDF documents. A booby-trapped PDF attachment is an old trick.
• Runtimes, background programs that other apps need in order to run. Java is a well-known example. Old copies often stay behind after the app that needed them is gone.
• Game launchers and chat apps, which start with Windows and talk to the internet all day.

Most apps have their own updater. Look for Check for updates in the app's Help or Settings menu, and say yes when it offers one. Apps from the Microsoft Store update through the Store. Open it, select Library, then Get updates.

Windows also has winget, the Windows Package Manager. It is a built-in tool you type short commands into, and it can check many apps at once:

1. Right-click the Start button and choose Terminal.
2. Type winget upgrade and press Enter. It lists apps that have a newer version.
3. Type winget upgrade --all and press Enter to update the ones it can. Some apps will show a User Account Control prompt first.

winget only knows apps in its catalog, so a few may still need their own updater.

The best patch of all is removing what you don't use. An app that is gone can't be attacked. Open Settings, then Apps, then Installed apps. Uninstall programs you no longer need. If you don't recognize a name, search it first, because some entries are drivers or parts other apps need.