The vulnerability, which could allow attackers to execute arbitrary code through specially crafted web pages, prompted an urgent update release to address the issue before widespread exploitation. The update will roll out over the coming days and weeks, but users should not wait for automatic updates and should manually verify they are running the latest version, especially given the critical nature of this security issue. Google has implemented a standard practice of restricting detailed vulnerability information until a majority of users have updated their browsers, providing a critical protection window for users to secure their systems. The security flaw tracked as CVE-2025-2476 has been classified as a critical use-after-free (UAF) memory vulnerability in Chrome’s Lens component. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The stable channel has been updated to version 134.0.6998.117/.118 for Windows and Mac and 134.0.6998.117 for Linux users. Successful exploitation of this vulnerability could allow attackers to execute arbitrary code with the same privileges as the logged-in user. In practical terms, when malicious data is introduced before memory consolidation occurs, attackers can potentially leverage this condition to execute arbitrary code on affected systems. Google’s AddressSanitizer, a memory error detection tool, is specifically designed to identify such flaws during development phases, highlighting their significance in modern browser security. While no active exploitation has been confirmed in the wild, Google’s critical rating underscores the urgency of users updating immediately. The Extended Stable channel has also been updated to version 134.0.6998.89 for Windows and Mac systems. On March 19, 2025, Google released security updates to address the vulnerability. Kaaviya is a Security Editor and fellow reporter with Cyber Security News. The vulnerability affects Chrome versions before 134.0.6998.117/.118 on Windows and Mac and 134.0.6998.117 on Linux platforms. A sophisticated threat actor dubbed "Weaver Ant," Web Shell Whisperer has emerged from China, deploying advanced web shell payloads across critical infrastructure sectors worldwide.
This Cyber News was published on cybersecuritynews.com. Publication date: Mon, 24 Mar 2025 11:30:05 +0000