A newly discovered zero-day vulnerability in Google Chrome has prompted an out-of-band security update to protect users against active exploitation. The flaw, tracked as CVE-2025-5419, has been classified as high severity with a CVSS score of 8.8, and affects Chrome’s V8 JavaScript and WebAssembly engine.
According to public vulnerability databases, the bug involves an out-of-bounds read and write, which could allow a remote attacker to corrupt memory on the heap by tricking a user into opening a specially crafted HTML page. Successful exploitation may lead to arbitrary code execution or browser crashes.
The issue has been fixed in Chrome version 137.0.7151.68 (and .69 for some platforms), which has been rolled out across Windows, macOS, and Linux. A configuration change was issued rapidly following discovery to contain the threat.
The vulnerability was originally reported on May 27, 2025, and a fix was deployed within 24 hours, highlighting the urgency of the situation. While technical details of the exploit remain undisclosed, it has been confirmed that the flaw has already been used in real-world attacks.
This marks the second known zero-day vulnerability exploited in the wild against Chrome in 2025, following CVE-2025-2783, which was previously linked to targeted operations.
🛡️ Recommendations
- Chrome users should immediately update to version 137.0.7151.68/.69 on all platforms.
- Users of Chromium-based browsers—including Microsoft Edge, Brave, Opera, and Vivaldi—are advised to apply available updates as soon as patches are released.
- Organizations should monitor browser versions in their environments to ensure timely patch deployment, especially where browser-based access to sensitive systems is permitted.
📌 SecurityX Insight:
Zero-day exploits targeting web browsers remain one of the fastest and most stealthy initial access vectors. This case reinforces the importance of maintaining automated update channels, enforcing application allowlisting, and adopting browser isolation strategies in environments handling sensitive data.
