Loading story…
Google released Chrome 140 in September 2025, addressing two major vulnerabilities: CVE-2025-10200 (critical, CVSS 9.8) and CVE-2025-10201 (high, CVSS 8.8). These flaws could allow remote code execution and sandbox escape, putting users at risk of data breaches and system compromise. Immediate browser updates are strongly recommended to mitigate exploitation risks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
1 event from the most recent confirmed update back to the earliest known activity.
Initial story creation
3 references tracked. Mallory keeps watching after this page renders.
securityonline.info
Open sourcethecyberthrone.in
Open sourcesecurityonline.info
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released security updates for Chrome for Desktop to address several high-severity vulnerabilities, including flaws in the V8 JavaScript engine. One of the vulnerabilities, CVE-2025-10585, was added to CISA's Known Exploited Vulnerabilities (KEV) catalog after a public exploit became available. Security advisories from both Google and government agencies urged users and administrators to update Chrome to the latest versions to mitigate the risk of exploitation. The patched vulnerabilities affect Chrome versions prior to 140.0.7339.207/.208 on Windows and Mac, and 140.0.7339.207 on Linux.
Jun 29, 2026
Google released an emergency update for its Chrome browser, version 142, to patch five security vulnerabilities, including three high-severity flaws that could allow remote code execution (RCE) on Windows, macOS, Linux, and Android platforms. The most critical vulnerability, CVE-2025-12725, is an out-of-bounds write in the WebGPU graphics interface, which could enable attackers to execute arbitrary code by corrupting system memory. Two additional high-severity vulnerabilities, CVE-2025-12726 in the Views component and CVE-2025-12727 in the V8 JavaScript engine, were also addressed, both posing significant risk for memory manipulation and potential code execution. Google has limited the release of technical details to prevent exploitation before users apply the update, but internal assessments rate the vulnerabilities with a CVSS 3.1 score of 8.8, indicating a direct and serious risk. The update is being distributed across all major desktop and mobile platforms, and users are strongly advised to update Chrome promptly to mitigate the risk of exploitation. Two medium-severity issues in the Omnibox were also fixed in this release.
Jun 29, 2026
Google released Chrome 142 to the stable channel for Windows, Mac, Linux, Android, and ChromeOS, addressing 20 security vulnerabilities, many of which are rated high severity. The update includes fixes for several critical issues in the V8 JavaScript engine, such as type confusion (CVE-2025-12428), inappropriate implementation (CVE-2025-12429, CVE-2025-12432, CVE-2025-12433, CVE-2025-12036), and race conditions, all of which could potentially allow remote code execution. Additional patches resolve use-after-free, out-of-bounds read, policy bypasses in Extensions, and security UI flaws that could mislead users about website authenticity. The Canadian Centre for Cyber Security issued an advisory urging users and administrators to update Chrome to version 142.0.7444.59/60 or later on Windows, Mac, and Linux platforms to mitigate these vulnerabilities. The advisory highlights the importance of promptly applying security updates to protect against exploitation of these critical flaws, especially those affecting the V8 engine and browser security components.
Jul 12, 2026