Executive brief
Google Chrome and other Chromium-based browsers like Microsoft Edge are affected by a critical security flaw in their JavaScript engine. An attacker can exploit this by tricking a user into visiting a specially crafted website, potentially leading to unauthorized access to data or the ability to run malicious code on the user's computer. This vulnerability is known to be actively exploited in the wild, making immediate updates essential to protect corporate data and user privacy.
Technical details
An out-of-bounds (OOB) read and write vulnerability exists in the V8 JavaScript engine within Google Chromium. The flaw is triggered when the engine improperly handles memory access during the processing of JavaScript, leading to heap corruption. A remote, unauthenticated attacker can exploit this by hosting a malicious HTML page and inducing a user to visit it. Successful exploitation can result in arbitrary code execution within the browser's sandbox or information disclosure. This vulnerability has been observed in active attacks. Users should update Google Chrome to version 137.0.7151.68 or later and Microsoft Edge to version 137.0.3296.62 or later.
Affected products
- Google Chrome prior to 137.0.7151.68
- Microsoft Edge Chromium prior to 137.0.3296.62
Timeline
- 2025-06-02: disclosed
- 2025-06-05: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2025-06-05: patched: Stable channel updates released for Chrome and Edge