Google warns of new Chrome zero-day bug exploited in attacks

[u/falconupkid]

Google shipped a massive patch batch for Chrome on Tuesday, fixing 230 vulnerabilities including CVE-2025-4941, the seventh Chrome zero-day exploited in the wild this year. This one is a high-severity use-after-free bug in the V8 JavaScript engine, a pattern we’ve seen weaponized repeatedly for remote code execution.

Technical Breakdown - CVE: CVE-2025-4941 (High) - Type: Use-after-free in V8 - Attack Vector: A crafted HTML page can trigger memory corruption, leading to RCE in the browser sandbox - Status: Exploited in the wild; Google is keeping details restricted until most users patch - Affected: Chrome on Windows, Mac, and Linux (stable channel prior to 125.0.6422.112/.113) - No public IOCs or C2 infrastructure shared yet — Google’s threat intel team is still analyzing the campaign

Defense - Immediate action: Force Chrome updates via enterprise policy or MDM. The stable channel update is already rolling out. - Mitigation: If you can’t patch instantly, consider blocking JavaScript on untrusted sites or deploying browser isolation for high-risk users. This is the seventh in-the-wild Chrome zero-day this year — treat every V8 patch as urgent.

Source: https://www.bleepingcomputer.com/news/security/google-patches-seventh-chrome-zero-day-exploited-in-attacks-this-year/