Multiple Chrome Vulnerabilities Let Attackers Execute Arbitrary Code

Enterprise administrators can force updates through group policies (version 135.0.7049.52+). Google has restricted detailed technical disclosures until most users update, following standard coordinated vulnerability disclosure practices. The stable channel update (135.0.7049.52 for Linux, 135.0.7049.41/42 for Windows/macOS) comes with urgent patches for multiple memory corruption and implementation flaws actively exploited in the wild. Cyber Security News is a Dedicated News Platform For Cyber News, Cyber Attack News, Hacking News & Vulnerability Analysis. Reported by Sven Dysthe through Chrome’s Vulnerability Reward Program, this memory corruption flaw carries a “High” severity rating. This update highlights Chrome’s ongoing security challenges despite massive investments in sandboxing and process isolation. The most severe vulnerability (CVE-2025-3066) involves a use-after-free flaw in navigation processes that could let attackers execute arbitrary code via crafted web pages. Notably, one extension vulnerability report dates back to 2017, revealing long-standing architectural issues in Chrome’s permission model. The update addresses fourteen vulnerabilities, including high-severity flaws that could enable remote code execution. Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. Google has rolled out a critical security update for Chrome 135 across all desktop platforms. External researchers claimed $17,000 in bounties for identifying vulnerabilities, with TU Wien researcher Philipp Beer receiving the highest individual payout. The inclusion of vulnerabilities reported as early as 2017 suggests some architectural limitations persist in the browser’s 16-year-old codebase.

This Cyber News was published on cybersecuritynews.com. Publication date: Wed, 02 Apr 2025 11:10:06 +0000

Cyber News related to Multiple Chrome Vulnerabilities Let Attackers Execute Arbitrary Code

Google Online Security Blog: Sustaining Digital Certificate Security - The Chrome Security Team prioritizes the security and privacy of Chrome's users, and we are unwilling to compromise on these values. The Chrome Root Program Policy states that CA certificates included in the Chrome Root Store must provide value to ...
11 months ago Security.googleblog.com

Google Chrome Zero-Day Bug Under Attack, Allows Code Injection - Google has patched a high-severity zero-day bug in its Chrome Web browser that attackers are actively exploiting. The vulnerability, assigned as CVE-2024-0519, is the first Chrome zero-day bug that Google has disclosed in 2024, and the second in the ...
1 year ago Darkreading.com CVE-2024-0519 CVE-2024-0517 CVE-2024-0518 Hunters

Google Patches Another Chrome Zero-Day as Browser Attacks Mount - For the fourth time since August, Google has disclosed a bug in its Chrome browser technology that attackers were actively exploiting in the wild before the company had a fix for it. Integer Overflow Bug The latest zero-day, which Google is tracking ...
1 year ago Darkreading.com CVE-2023-6345 CVE-2023-4863 CVE-2023-5217 CVE-2023-28205 CVE-2023-32409 CVE-2023-28204 CVE-2023-32373

Critical Chrome Vulnerability Let Attackers Steal Data & Gain Unauthorized Access - Google has issued an urgent security update for its Chrome browser after two critical vulnerabilities were discovered. This vulnerability can allow attackers to execute arbitrary code by exploiting how Chrome processes certain media files, ...
2 months ago Cybersecuritynews.com CVE-2025-3619

Google Chrome 0-Day Vulnerability Exploited in the Wild - Update Now - The tech giant announced yesterday that Chrome’s Stable channel has been updated to version 136.0.7103.113/.114 for Windows and Mac, and 136.0.7103.113 for Linux to address four security issues, including a high-severity zero-day flaw. Google ...
1 month ago Cybersecuritynews.com CVE-2025-4609

CISA adds Check Point Quantum Security Gateways and Linux Kernel flaws to its Known Exploited Vulnerabilities catalog - CISA adds Apache Flink flaw to its Known Exploited Vulnerabilities catalog. CISA adds D-Link DIR router flaws to its Known Exploited Vulnerabilities catalog. CISA adds Google Chrome zero-days to its Known Exploited Vulnerabilities catalog. CISA adds ...
1 year ago Securityaffairs.com

Multiple Chrome Vulnerabilities Let Attackers Execute Arbitrary Code - Enterprise administrators can force updates through group policies (version 135.0.7049.52+). Google has restricted detailed technical disclosures until most users update, following standard coordinated vulnerability disclosure practices. The stable ...
2 months ago Cybersecuritynews.com CVE-2025-3066

Google patches third exploited Chrome zero-day in a week - Google has released a new emergency Chrome security update to address the third zero-day vulnerability exploited in attacks within a week. The company fixed the zero-day flaw with the release of 125.0.6422.60/.61 for Mac/Windows and 125.0.6422.60. ...
1 year ago Bleepingcomputer.com CVE-2024-4947 CVE-2024-0519 CVE-2024-2887 CVE-2024-3159 CVE-2024-4671 CVE-2024-4761

Google Patches Six Vulnerabilities With First Chrome Update of 2024 - Google on Wednesday announced the first Chrome security update of 2024, which resolves six vulnerabilities, including four reported by external researchers. All the four externally reported security defects are high-severity memory safety flaws, but ...
1 year ago Securityweek.com CVE-2024-0222 CVE-2024-0223 CVE-2024-0224 CVE-2024-0225

Alert: New Chrome Zero-Day Vulnerability Being Exploited - Google, in light of recent events, has launched a critical update for a high-severity Chrome zero-day vulnerability. As per recent reports, Google claims that the vulnerability has been actively exploited. It's worth noting that the vulnerability ...
1 year ago Securityboulevard.com CVE-2023-7024 CVE-2023-2033 CVE-2023-2136 CVE-2023-3079 CVE-2023-4762 CVE-2023-6345

The Exploration of Static vs Dynamic Code Analysis - Two essential methodologies employed for this purpose are Static Code Analysis and Dynamic Code Analysis. Static Code Analysis involves the examination of source code without its execution. In this exploration of Static vs Dynamic Code Analysis, ...
1 year ago Feeds.dzone.com

Chrome 120 Patches 10 Vulnerabilities - Google on Tuesday announced the release of Chrome 120 to the stable channel with patches for 10 vulnerabilities. Of the resolved issues, five were reported by external researchers, who received a total of $15,000 in bug bounty rewards, according to ...
1 year ago Securityweek.com CVE-2023-6508 CVE-2023-6509 CVE-2023-6345

Strobes 2023 Pentesting Recap: Trends, Stats, and How PTaaS is Transforming Cybersecurity - This article covers some amazing statistics on what category of vulnerabilities we commonly report across 100s of customers, and how we reduce compliance times and turn around time to reporting critical vulnerabilities. In a different article, we ...
1 year ago Securityboulevard.com

Google Releases Eighth Zero-Day Patch of 2023 for Chrome - Google has issued an urgent update to address a recently discovered vulnerability in Chrome that has been under active exploitation in the wild, marking the eighth zero-day vulnerability identified for the browser in 2023. Identified as ...
1 year ago Darkreading.com CVE-2023-7024

Microsoft Patch Tuesday 2024: 49 Vulnerabilities are fixed - Microsoft released its first patch on Tuesday, 2024, in which nearly 49 vulnerabilities have been fixed in Microsoft products and 5 vulnerabilities in non-Microsoft products. Among these 49 vulnerabilities, there were 12 remote code execution ...
1 year ago Cybersecuritynews.com CVE-2024-20674 CVE-2024-20700 CVE-2024-0057

Google Chrome Vulnerability Let Attackers Escape Payload from Sandbox - Technical Details Disclosed - A critical vulnerability in Google Chrome has recently been discovered that allows malicious actors to break out of the browser’s protective sandbox environment, potentially giving attackers access to the underlying operating system. This ...
1 month ago Cybersecuritynews.com

CISA warns of hackers exploiting Chrome, EoL D-Link bugs - The U.S. Cybersecurity & Infrastructure Security Agency has added three security vulnerabilities to its 'Known Exploited Vulnerabilities' catalog, one impacting Google Chrome and two affecting some D-Link routers. Adding the issues to the KEV catalog ...
1 year ago Bleepingcomputer.com CVE-2024-4761 CVE-2021-40655

Why CVEs Are an Incentives Problem - I've been thinking about some of these unintended consequences in the context of a growing problem faced by all of us in cybersecurity: how a fast-rising tide of software vulnerabilities tracked as common vulnerabilities and exposures - are reported ...
1 year ago Darkreading.com

Google Chrome now auto-upgrades to secure connections for all users - Google has taken a significant step towards enhancing Chrome internet security by automatically upgrading insecure HTTP requests to HTTPS requests for 100% of users. A limited rollout of this feature in Google Chrome began in July, but as of October ...
1 year ago Bleepingcomputer.com

Chrome Use After Free Vulnerability Let Attackers Execute Remote Code - Security experts indicate that successful exploitation of this vulnerability would likely begin with a specially crafted webpage containing JavaScript code designed to trigger memory corruption. The high-severity Vulnerability tracked as ...
2 months ago Cybersecuritynews.com CVE-2025-3066

Google Takes Down Over 50,000 Instances of Malicious Chrome Extensions - Google recently took down over 50,000 Chrome browser extensions after discovering that they were involved in malicious activity. The malicious activity included advertising click fraud, downloading malware, and displaying adware. According to Google, ...
2 years ago Thehackernews.com

Check if you're in Google Chrome's third-party cookie phaseout test - Google has started testing the phasing out of third-party cookies on Chrome, affecting about 1% of its users or approximately 30 million people. Learn how to check if you are part of the initial test. Third-party cookies, which track users' browsing ...
1 year ago Bleepingcomputer.com

Google Chrome To Roll Out Real-Time Phishing Protection - Google Chrome has been protecting users from malicious websites and files with Safe Browsing, which maintains a locally-stored list updated every 30-60 minutes. To address it, Chrome is introducing a new version of Safe Browsing that provides ...
1 year ago Cybersecuritynews.com

Multiple QNAP Severity Flaw Let Attackers Execute Remote Code - QNAP has released multiple security advisories for addressing several high, medium, and low-severity vulnerabilities in multiple products, including QTS, QuTS hero, Netatalk, Video Station, QuMagie, and QcalAgent. QNAP has also stated all the ...
1 year ago Gbhackers.com CVE-2023-39294 CVE-2023-39296 CVE-2023-47219 CVE-2023-47559 CVE-2023-47560 CVE-2023-41287 CVE-2023-41288 CVE-2022-43634 CVE-2023-41289

Chrome UAF Vulnerabilities Exploited in the Wild - In Chrome, UAFs have historically been a major source of critical security bugs, particularly within the browser process, which has direct access to sensitive user data and system resources. These flaws, rooted in improper memory management, have ...
1 month ago Cybersecuritynews.com