Google Issues Emergency Patch for Fourth Chrome Zero
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-6554 | Type Confusion in Google Chrome V8 Allows Arbitrary Read/Write (Actively Exploited) CVE-2025-6554 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine of Google Chrome, affecting versions prior to 138.0.7204.96. A remote attacker can trigger it by inducing a user to open a crafted HTML page, and the flaw permits arbitrary read and write within the browser renderer process. Successful exploitation yields high confidentiality and integrity impact, and V8 type confusion bugs are commonly used as the first stage toward a full browser compromise. Any user of an unpatched Chrome or Chromium-based browser is exposed, and the flaw is being actively exploited in the wild as a zero-day; CISA added it to the Known Exploited Vulnerabilities catalog on 2025-07-02. Ransomware usage is not confirmed (reported as unknown), and no public proof-of-concept is known. Do: Update Chrome to 138.0.7204.96 or later (check chrome://settings/help) and restart the browser to load the patched V8; users of Chromium-derived browsers (Edge, Brave, Opera, etc.) should install their vendor's corresponding V8 patch. Organizations must apply vendor mitigations or follow BOD 22-01 guidance given the KEV listing, and should inventory managed browsers and force-update policies to confirm rollout. | 8.1 | 13% | KEV |
| mass≈3+ billion Chrome users; effectively every desktop Chrome installation running a build older than 138.0.7204.96 |
Full article377 words · extracted from infosecurity-magazine.com · click to collapse
A critical security flaw in Google Chrome that was being actively exploited has been patched by the company.
The issue, tracked as CVE-2025-6554, is a type confusion vulnerability in Chrome’s V8 JavaScript and WebAssembly engine.
This flaw allowed attackers to perform arbitrary read and write operations by luring users to open specially crafted web pages. Google confirmed the vulnerability was already being exploited in the wild.
Flaw Detected by Google Threat Team
The bug was reported on June 25 by Clément Lecigne from Google’s Threat Analysis Group (TAG), a team known for uncovering sophisticated attacks linked to nation-state actors.
According to the National Vulnerability Database (NVD), the flaw affects Chrome versions before 138.0.7204.96 and could allow attackers to execute arbitrary code or crash programs.
The next day, on June 26, Google deployed a configuration change to the Stable channel across all platforms, mitigating the risk for users on Windows (versions 138.0.7204.96/.97), macOS (138.0.7204.92/.93) and Linux (138.0.7204.96).
Type Confusion: A High-Impact Vulnerability
Type confusion errors can have serious security implications. When a program incorrectly assumes the type of an object, attackers can manipulate the software to access memory out of bounds. This opens the door to:
-
Arbitrary code execution
-
Drive-by downloads
-
Spyware installations
-
Silent data exfiltration
TAG’s involvement suggests that the exploit may have been part of targeted campaigns against high-profile individuals, such as journalists, dissidents or political opponents. Google, however, has not disclosed technical details or confirmed who was targeted, citing user protection and ongoing patching as reasons for withholding information.
Urgent Update Advised for Chrome and Chromium-Based Browsers
While most users will receive the fix automatically, manual updates can be triggered by visiting Settings > Help > About Google Chrome.
Organizations managing multiple endpoints should ensure patch compliance and activate automated browser updates to maintain optimal security.
Other browsers built on Chromium, including Microsoft Edge, Brave, Opera and Vivaldi, are also potentially impacted and should be updated once fixes are released.
With CVE-2025-6554, Google has now addressed four zero-days this year. These earlier flaws included sandbox escapes and out-of-bounds memory weaknesses, one of which was linked to espionage campaigns targeting Russian institutions.
Image credit: viewimage / Shutterstock.com
Text extracted automatically; images, tables and formatting may be missing. Original: https://www.infosecurity-magazine.com/news/google-patch-chrome-zero-day/