In 2025, Google Chrome has faced multiple zero-day vulnerabilities actively exploited in the wild. Below is a summary of the key vulnerabilities reported this year, based on available information:
1. CVE-2025-2783 (March 2025):
• Description: A high-severity vulnerability in Chrome’s Mojo inter-process communication (IPC) framework on Windows, allowing attackers to bypass the browser’s sandbox protection. It was used in a sophisticated cyber-espionage campaign dubbed “Operation ForumTroll,” targeting Russian media, educational institutions, and government organizations.
• Exploitation: Attackers used personalized phishing emails with malicious links, requiring only a click to trigger the exploit. The campaign aimed at espionage, deploying malware via a sandbox escape and a secondary remote code execution exploit.
• Patch: Fixed in Chrome version 134.0.6998.177/.178 for Windows on March 25, 2025. Kaspersky researchers Boris Larin and Igor Kuznetsov discovered and reported the flaw.
2. CVE-2025-4664 (May 2025):
• Description: An insufficient policy enforcement vulnerability in Chrome’s Loader logic, potentially enabling unauthorized code execution or sandbox escape.
• Exploitation: Google confirmed reports of active exploitation, though specific details were not disclosed. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities Catalog, urging patches by June 5, 2025.
• Patch: Addressed in Chrome version 136.0.3240.76 for Windows and macOS. Microsoft Edge and other Chromium-based browsers were also affected.
3. CVE-2025-5419 (June 2025):
• Description: A high-severity out-of-bounds read/write vulnerability in Chrome’s V8 JavaScript and WebAssembly engine, allowing heap corruption via a crafted HTML page.
• Exploitation: Actively exploited, with reports suggesting involvement of state-sponsored actors. Discovered by Google’s Threat Analysis Group (TAG) researchers Clรฉment Lecigne and Benoรฎt Sevens on May 27, 2025.
• Patch: Mitigated on May 28, 2025, with a configuration change and fully patched in Chrome versions 137.0.7151.68/.69 for Windows/macOS and 137.0.7151.68 for Linux.
4. CVE-2025-6554 (July 2025):
• Description: A high-severity type confusion flaw in the V8 JavaScript and WebAssembly engine (CVSS score: 8.1), enabling arbitrary read/write operations via a crafted HTML page.
• Exploitation: Actively exploited in targeted attacks, potentially by nation-state actors or for surveillance. Discovered by Clรฉment Lecigne of Google’s TAG on June 25, 2025.
• Patch: Fixed in Chrome versions 138.0.7204.96/.97 for Windows, 138.0.7204.92/.93 for macOS, and 138.0.7204.96 for Linux, released on June 26, 2025.
5. CVE-2025-6558 (July 2025):
• Description: A high-severity vulnerability (CVSS score: 8.8) due to insufficient validation of untrusted input in the ANGLE graphics layer and GPU, allowing sandbox escape via a crafted HTML page.
• Exploitation: Actively exploited, with no user interaction beyond visiting a malicious site required. Discovered by Google TAG researchers Clรฉment Lecigne and Vlad Stolyarov on June 23, 2025. Also affected Apple’s WebKit, patched in iOS 18.6 and iPadOS 18.6.
• Patch: Fixed in Chrome versions 138.0.7204.157/.158 for Windows/macOS and 138.0.7204.157 for Linux, released on July 15, 2025. Other Chromium-based browsers (Edge, Brave, Opera, Vivaldi) were advised to apply fixes.
Mitigation Recommendations:
• Update Immediately: Ensure Chrome is updated to the latest version (check via Settings > Help > About Google Chrome). Enable automatic updates for faster patching.
• Chromium-Based Browsers: Update Microsoft Edge, Brave, Opera, or Vivaldi as patches become available.
• Security Practices:
• Use a reputable malware scanner to detect potential infections.
• Be cautious of phishing emails and suspicious links, as many exploits require only a single click or page visit.
• For organizations, implement automated patch management and monitor browser version compliance.
• Additional Protection: Consider multi-layered security solutions like Kaspersky Next XDR Expert and leverage threat intelligence services for real-time updates on exploits.
Notes:
• Google restricts technical details until most users are patched to prevent further exploitation.
• These vulnerabilities highlight the ongoing risk of zero-day exploits in Chrome, often targeted by advanced persistent threats (APTs) for espionage or surveillance.
• No additional zero-day vulnerabilities for Chrome in 2025 were reported in the provided data beyond July, but users should stay vigilant for new advisories.
For the latest updates, check Google’s Chrome Release Page or CISA’s Known Exploited Vulnerabilities Catalog. If you need assistance identifying vulnerable systems or applying patches, services like Qualys Patch Management or Secure-ISS can help.