Google has urgently patched two high-severity heap buffer overflow vulnerabilities in its Chrome browser, CVE-2025-0999, and CVE-2025-1426, that could allow attackers to execute arbitrary code and seize control of affected systems. Heap buffer overflow vulnerability enables attackers to overwrite dynamically allocated memory regions and execute arbitrary code. The V8 engine vulnerability (CVE-2025-0999) arises from improper memory management when processing JavaScript objects, enabling heap corruption through crafted HTML pages. This vulnerability arises when programs write data beyond the bounds of memory blocks allocated on the heap a dynamically managed memory area used for runtime data storage. Both vulnerabilities grant remote code execution (RCE) capabilities, potentially enabling full system compromise, data theft, or lateral movement within networks. While no active exploitation has been confirmed, the similarities to prior Chrome zero-days, such as CVE-2022-4135, a GPU heap overflow exploited in 2022, heighten concerns. Enterprise administrators should prioritize deploying the update across networks, as delayed patching leaves systems exposed to drive-by download attacks or phishing campaigns delivering exploit code.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 19 Feb 2025 02:45:19 +0000