Google has issued an urgent security update for its Chrome browser after two critical vulnerabilities were discovered. This vulnerability can allow attackers to execute arbitrary code by exploiting how Chrome processes certain media files, potentially leading to full system compromise and data theft. Security agencies and Google strongly urge all Chrome users to update their browsers immediately to the latest stable version. Google credits external security researchers Elias Hohl and @retsew0x01 for reporting the vulnerabilities, highlighting the importance of collaboration in maintaining browser security. Users who store passwords, credit card details, or personal information in Chrome are especially vulnerable to identity theft and fraud if the browser is not updated promptly. Security experts warn that these vulnerabilities are particularly dangerous because they can be exploited remotely, requiring only that a user visit a malicious website or interact with compromised content. Once exploited, attackers could steal passwords, financial information, and other sensitive data stored in the browser or even take control of the affected device. These vulnerabilities could allow attackers to steal sensitive data and gain unauthorized access to users’ systems. The vulnerabilities impact all users running outdated versions of Google Chrome on desktop platforms. Google has responded by releasing Chrome version 135.0.7049.95/.96 for Windows and Mac and 135.0.7049.95 for Linux, which addresses these critical flaws. Cybersecurity experts emphasize that regular browser updates are essential to protect against evolving threats and prevent data breaches or system compromise. The flaws, identified as CVE-2025-3619 and CVE-2025-3620, affect Chrome versions prior to 135.0.7049.95/.96 for Windows and Mac and 135.0.7049.95 for Linux. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. The company’s internal security tools, including AddressSanitizer, MemorySanitizer, and libFuzzer, played a key role in detecting and mitigating these threats before they could be widely exploited. The second, CVE-2025-3620, is a “use-after-free” flaw in the USB component, which could also be leveraged to execute malicious code or gain unauthorized access to the system. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security.
This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 16 Apr 2025 02:00:12 +0000