Loading story…
Google released Chrome desktop updates to fix multiple security vulnerabilities, including actively exploited zero-days affecting versions older than 125.0.6422.60/.61 on Windows and macOS and older than 125.0.6422.60 on Linux. The most serious issue, CVE-2024-4947, is a high-severity type confusion flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild.
The updates also addressed other flaws, including CVE-2024-4761, an out-of-bounds write in V8 and WebAssembly, CVE-2024-4671, a use-after-free issue in Visuals, CVE-2024-4948, a use-after-free in Dawn, CVE-2024-4949, a use-after-free in V8, and CVE-2024-4950, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
3 events from the most recent confirmed update back to the earliest known activity.
Google released a Stable Channel desktop update with nine security fixes, including CVE-2024-4947 in V8. Google stated that CVE-2024-4947 was being exploited in the wild.
Vasily Berdnikov and Boris Larin of Kaspersky reported CVE-2024-4947, a high-severity type confusion vulnerability in Chrome's V8 engine. Google later said an exploit for the flaw exists in the wild.
CSIRT.SK published a notice stating that Google had released Chrome updates to fix three actively exploited zero-day vulnerabilities: CVE-2024-4947, CVE-2024-4761, and CVE-2024-4671. The notice identified affected Chrome versions on Windows, Mac, and Linux and urged immediate updating.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released an urgent Chrome desktop update to fix **74 security issues**, including `CVE-2026-11645`, a high-severity **out-of-bounds memory access** vulnerability in the **V8 JavaScript engine**. Google said an exploit for the flaw exists **in the wild**, making it the most pressing issue in the release. The update affects Chrome on **Windows, macOS, and Linux**, and Google limited technical details for some bugs until more users receive the patch. The release also addresses multiple additional memory-safety flaws, including **use-after-free** bugs in components such as **Ozone**, **Bluetooth**, and **tab strips**. HKCERT separately published an advisory covering multiple Chrome vulnerabilities, reinforcing the breadth of the fixes. Organizations are being urged to update Chrome immediately and ensure browser restarts are completed so the patched version is applied across managed endpoints.
Aug 15, 2026
Google released Chrome stable-channel updates to address multiple security vulnerabilities, including **CVE-2024-5274**, a high-severity **type confusion** flaw in the **V8 JavaScript engine** that Google said was being exploited in the wild. The company shipped patched desktop versions `125.0.6422.112/.113` for Windows and Mac and `125.0.6422.112` for Linux, while limiting technical details until more users had updated. The bug was reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security. Subsequent Chrome advisories and release notes show Google continuing to issue stable-channel fixes for broader sets of browser and platform weaknesses, including advisories describing **seven vulnerabilities with three critical flaws** and ChromeOS updates carrying additional browser and third-party security patches. The later fixes covered high-, medium-, and low-severity issues such as **use-after-free**, **type confusion**, **race conditions**, **bad cast**, and implementation errors across components including **V8**, **WebRTC**, **DevTools**, **Downloads**, **Password Manager**, and **WebGPU**, underscoring the ongoing need for rapid Chrome and ChromeOS patch deployment.
Aug 16, 2026
Google released emergency Chrome updates to fix two **high-severity zero-day vulnerabilities**, `CVE-2026-3909` and `CVE-2026-3910`, that are being **exploited in the wild**. Advisory reporting says the flaws can enable **data manipulation** and **security restriction bypass**, prompting a **high-risk** assessment. Google has not disclosed attack details, indicating access to technical information may remain restricted until more users have installed the fixes. Technical reporting identifies `CVE-2026-3909` as an **out-of-bounds write** in **Skia**, Chrome’s graphics library, and `CVE-2026-3910` as an **inappropriate implementation** issue in the **V8 JavaScript and WebAssembly engine**. Google said both were patched within days of being reported, with fixes rolling out to the Stable Desktop channel for **Windows `146.0.7680.75`**, **macOS `146.0.7680.76`**, and **Linux `146.0.7680.75`**. The company warned that full update deployment may take days or weeks, making prompt browser updates important while exploitation is ongoing.
Jun 29, 2026