Google has released emergency updates to patch another Chrome zero-day vulnerability exploited in attacks, marking the fourth such flaw fixed since the start of the year. The company fixed the zero-day for users in the Stable Desktop channel, with new versions rolling out worldwide to Windows (138.0.7204.96/.97), Mac (138.0.7204.92/.93), and Linux users (138.0.7204.96) one day after the issue was reported to Google. The bug was discovered by Clément Lecigne of Google's Threat Analysis Group (TAG), a collective of security researchers focused on defending Google customers from state-sponsored and other similar attacks. Google TAG frequently discovers zero-day exploits deployed by government-sponsored threat actors in targeted attacks to infect high-risk individuals, including opposition politicians, dissidents, and journalists, with spyware. Google released another set of emergency security updates in May to address a Chrome zero-day (CVE-2025-4664) that can allow attackers to hijack accounts. In 2024, Google patched a total of 10 zero-day vulnerabilities that were either exploited in attacks or demoed during Pwn2Own hacking competitions. This is the fourth actively exploited Google Chrome zero-day fixed since the start of the year, with three more patched in March, May, and June. One month later, the company addressed an out-of-bounds read and write weakness in Chrome's V8 JavaScript engine discovered by Google TAG's Benoît Sevens and Clément Lecigne. Although the security updates patching CVE-2025-6554 could take days or weeks to reach all users, according to Google, they were immediately available when BleepingComputer checked for updates earlier today. Even though Google stated that this vulnerability was exploited in the wild, the company has yet to share technical details or additional information regarding these attacks. "Google is aware that an exploit for CVE-2025-6554 exists in the wild," the browser vendor said in a security advisoryissued on Monday. We will also retain restrictions if the bug exists in a third party library that other projects similarly depend on, but haven't yet fixed," Google said. The first, a high-severity sandbox escape flaw (CVE-2025-2783) reported by Kaspersky's Boris Larin and Igor Kuznetsov, was used in espionage attacks targeting Russian government organizations and media outlets with malware.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Tue, 01 Jul 2025 11:00:17 +0000