Google fixes critical Chrome flaw, researcher earns $43K
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-10200 +1 in the same advisory: …10201 | Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a craft Use after free in Serviceworker in Google Chrome on Desktop prior to 140.0.7339.127 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical) NVD description · AI analysis pending | 8.8 | <1% |
| — |
Full article203 words · extracted from securityaffairs.com · click to collapse
Pierluigi Paganini
September 11, 2025
Google addressed a critical use-after-free vulnerability in its Chrome browser that could potentially lead to code execution.
A researcher earned $43000 from Google for reporting a critical Chrome vulnerability, tracked as CVE-2025-10200, in the Serviceworker component.
A use-after-free (UAF) occurs when a program accesses memory after it has been freed. This can cause crashes, data corruption, or enable exploits like remote code execution. Common in C/C++ programs, UAFs are frequent in browsers and OS software handling manual memory management.
The researcher Looben Yang reported the vulnerability to Google on August 22, 2025.
Google rolled out a Chrome update that addressed this issue and another bug, tracked as CVE-2025-10201. CVE-2025-10201 is an inappropriate implementation in Mojo, which is an inter-process communication (IPC) framework used by Google Chrome.
Researchers Sahan Fernando and an anonymous expert reported the flaw CVE-2025-10201 and earned $30000 from Google for reporting this issue.
The Chrome update is being released as version 140.0.7339.127/.128 for Windows, 140.0.7339.132/.133 for macOS, and 140.0.7339.127 for Linux.
Google did not reveal if any of these vulnerabilities have been actively exploited in attacks in the wild.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/182107/security/google-fixes-critical-chrome-flaw-researcher-earns-43k.html