Loading story…
Google released Chrome stable-channel updates to address multiple security vulnerabilities, including CVE-2024-5274, a high-severity type confusion flaw in the V8 JavaScript engine that Google said was being exploited in the wild. The company shipped patched desktop versions 125.0.6422.112/.113 for Windows and Mac and 125.0.6422.112 for Linux, while limiting technical details until more users had updated. The bug was reported by Clément Lecigne of Google’s Threat Analysis Group and Brendon Tiszka of Chrome Security.
Subsequent Chrome advisories and release notes show Google continuing to issue stable-channel fixes for broader sets of browser and platform weaknesses, including advisories describing seven vulnerabilities with three critical flaws and ChromeOS updates carrying additional browser and third-party security patches. The later fixes covered high-, medium-, and low-severity issues such as use-after-free, type confusion, race conditions, bad cast, and implementation errors across components including V8, WebRTC, DevTools, Downloads, Password Manager, and WebGPU, underscoring the ongoing need for rapid Chrome and ChromeOS patch deployment.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
15 events from the most recent confirmed update back to the earliest known activity.
Chrome recorded CVE-2025-13633, a high-severity use-after-free vulnerability in Digital Credentials, as having been reported on this date.
Chrome recorded CVE-2025-13720, a medium-severity bad cast vulnerability in Loader, as having been reported on this date.
Shreyas Penkar (@streypaws) reported CVE-2025-13630, a high-severity type confusion vulnerability in V8, to Chrome.
Anonymous reported CVE-2025-13640, a low-severity inappropriate implementation issue in Passwords, to Chrome.
Philipp Hancke reported CVE-2025-13639, a low-severity inappropriate implementation issue in WebRTC, to Chrome.
sherkito reported CVE-2025-13638, a low-severity use-after-free vulnerability in Media Stream, to Chrome.
Khalil Zhani reported CVE-2025-13636, a low-severity inappropriate implementation issue in Split View, to Chrome.
Leandro Teles reported CVE-2025-13632, a medium-severity inappropriate implementation issue in DevTools, to Chrome.
Hafiizh reported CVE-2025-13635, a low-severity inappropriate implementation issue in Downloads, to Chrome.
Hafiizh reported CVE-2025-13637, a low-severity inappropriate implementation issue in Downloads, to Chrome.
Chrome recorded CVE-2025-13721, a medium-severity race condition in V8, as having been reported on this date.
Google announced Chrome 125 stable updates for Windows, Mac, and Linux that fixed CVE-2024-5274. Google also said an exploit for the vulnerability exists in the wild.
Clément Lecigne of Google's Threat Analysis Group and Brendon Tiszka of Chrome Security reported CVE-2024-5274, a high-severity type confusion flaw in V8, to Google.
A Chromium issue titled "Security: XSS filter bypass in Chrome [41068074]" was published in the Chromium issue tracker.
Google announced a ChromeOS Stable channel update to OS version 16463.51.0 with browser version 143.0.7499.150 for most devices. The release included AMD third-party fixes and multiple Chrome browser security fixes, including CVE-2025-13630, CVE-2025-13633, CVE-2025-13720, and CVE-2025-13721.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
gmcsirt.gm
Open sourcegmcsirt.gm
Open sourcechromereleases.googleblog.com
Open sourcechromereleases.googleblog.com
Open sourcecode.google.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome desktop updates to fix multiple security vulnerabilities, including **actively exploited zero-days** affecting versions older than `125.0.6422.60/.61` on Windows and macOS and older than `125.0.6422.60` on Linux. The most serious issue, `CVE-2024-4947`, is a high-severity **type confusion** flaw in the V8 JavaScript engine that can lead to out-of-bounds memory access and potentially remote code execution; Google said an exploit for the bug exists in the wild. The updates also addressed other flaws, including `CVE-2024-4761`, an out-of-bounds write in V8 and WebAssembly, `CVE-2024-4671`, a use-after-free issue in Visuals, `CVE-2024-4948`, a use-after-free in Dawn, `CVE-2024-4949`, a use-after-free in V8, and `CVE-2024-4950`, an implementation issue in Downloads. Google and national CSIRT reporting warned that successful exploitation could enable code execution, crashes, or exposure of sensitive data, and urged users to update Chrome immediately while some technical details remain temporarily restricted until broad patch adoption.
Aug 15, 2026
Google released Chrome fixes for multiple high-severity vulnerabilities in the V8 JavaScript engine, including `CVE-2025-10891`, `CVE-2025-10892`, and `CVE-2025-9864`, that could be triggered when a user visits a malicious web page. The flaws include integer overflows and a use-after-free condition that can cause heap corruption in the browser renderer and potentially lead to arbitrary code execution. A related bulletin also lists `CVE-2025-10890`, a V8 side-channel information disclosure issue, alongside the two integer overflow bugs, warning that successful exploitation could expose sensitive data or enable full system compromise. Google said the affected Chrome builds were patched across Windows, macOS, and Linux in the `140.0.7339` release line, with fixes landing in versions including `140.0.7339.80/.81` and later `140.0.7339.207/.208` depending on the flaw and platform. Several of the vulnerabilities were reportedly identified by Google’s AI-based Big Sleep system, and no public proof-of-concept exploits were cited in the referenced reports. Organizations using Chrome or Chromium-based browsers were urged to deploy the vendor updates promptly because the bugs are reachable through routine web browsing and may also affect downstream browsers that have not yet incorporated the upstream patches.
Jun 29, 2026
Google released an urgent Chrome desktop update to fix **74 security issues**, including `CVE-2026-11645`, a high-severity **out-of-bounds memory access** vulnerability in the **V8 JavaScript engine**. Google said an exploit for the flaw exists **in the wild**, making it the most pressing issue in the release. The update affects Chrome on **Windows, macOS, and Linux**, and Google limited technical details for some bugs until more users receive the patch. The release also addresses multiple additional memory-safety flaws, including **use-after-free** bugs in components such as **Ozone**, **Bluetooth**, and **tab strips**. HKCERT separately published an advisory covering multiple Chrome vulnerabilities, reinforcing the breadth of the fixes. Organizations are being urged to update Chrome immediately and ensure browser restarts are completed so the patched version is applied across managed endpoints.
Aug 15, 2026