Google on Monday launched out-of-band fixes to deal with three safety points in its Chrome browser, together with one which it stated has come beneath energetic exploitation within the wild.
The high-severity flaw is being tracked as CVE-2025-5419, and has been flagged as an out-of-bounds learn and write vulnerability within the V8 JavaScript and WebAssembly engine.
“Out of bounds learn and write in V8 in Google Chrome previous to 137.0.7151.68 allowed a distant attacker to probably exploit heap corruption through a crafted HTML web page,” reads the description of the bug on the NIST’s Nationwide Vulnerability Database (NVD).
Google credited Clement Lecigne and Benoît Sevens of Google Menace Evaluation Group (TAG) with discovering and reporting the flaw on Might 27, 2025. It additionally famous that the difficulty was addressed the following day by pushing out a configuration change to the Steady model of the browser throughout all platforms.
As is customary, the advisory is gentle on particulars relating to the character of the assaults leveraging the vulnerability or the id of the menace actors perpetrating them. That is carried out so to make sure that a majority of customers are up to date with a repair and to forestall different unhealthy actors from becoming a member of the exploitation bandwagon.
“Google is conscious that an exploit for CVE-2025-5419 exists within the wild,” the tech big acknowledged.
CVE-2025-5419 is the second actively exploited zero-day to be patched by Google this 12 months after CVE-2025-2783 (CVSS rating: 8.3), which was recognized by Kaspersky as being weaponized in assaults concentrating on organizations in Russia.
Customers are really helpful to improve to Chrome model 137.0.7151.68/.69 for Home windows and macOS, and model 137.0.7151.68 for Linux to safeguard towards potential threats. Customers of Chromium-based browsers resembling Microsoft Edge, Courageous, Opera, and Vivaldi are additionally suggested to use the fixes as and once they grow to be accessible.
