Exploited Google Chrome zero-days added to US must-patch list