Chrome Security Update – High-Severity Vulnerabilities Lead to Code Execution

Google has officially promoted Chrome 137 to the stable channel for Windows, Mac, and Linux platforms, marking a significant milestone in browser security and artificial intelligence integration. The Chrome team announced the release on May 27, 2025, with the update rolling out globally over the coming days and weeks.

Chrome 137.0.7151.55 for Linux and 137.0.7151.55/56 for Windows and Mac delivers substantial security improvements, addressing 11 vulnerabilities identified by both external researchers and internal security teams.

The update tackles several high-severity issues, including CVE-2025-5063, a use-after-free vulnerability in Compositing reported by an anonymous researcher on April 18, 2025, and CVE-2025-5280, an out-of-bounds write issue in V8 discovered by security researcher pwn2car on May 12, 2025.

Google has implemented a comprehensive bug bounty program, rewarding security researchers for their contributions. Notable payments include $4,000 for Maurice Dauer’s discovery of inappropriate implementation in the Background Fetch API, $2,000 for NDevTK’s FileSystemAccess API findings, and $1,000 for Mohit Raj’s identification of messaging vulnerabilities.

The company continues its commitment to transparency while maintaining responsible disclosure practices, restricting access to bug details until most users receive the security patches.

The most groundbreaking feature in Chrome 137 is the integration of Google’s Gemini Nano large language model, which provides on-device artificial intelligence capabilities to combat sophisticated cyber threats.

This innovation targets tech support scams explicitly, which have become increasingly prevalent and sophisticated in their approach to deceiving users.

The AI-powered system operates entirely on users’ devices, ensuring privacy while analyzing webpage content in real-time. When Chrome detects characteristic scam triggers, such as misuse of keyboard-lock APIs, Gemini Nano evaluates the page’s intent by processing text, layout, and behavioral cues.

This approach enables Chrome to detect deceptive patterns and generate security signals for Google’s Safe Browsing service, providing protection against threats that typically exist for fewer than 10 minutes on average.

Beyond security improvements, Chrome 137 introduces several significant enhancements to the web platform. The update includes support for floating-point color types in canvas rendering contexts, essential for high-precision applications such as medical visualization and high dynamic range content.

Additionally, the browser now supports SVG <use> elements that can reference external documents’ root elements without requiring explicit fragment identifiers, streamlining web development workflows.

The release also implements Document-Isolation-Policy, enabling documents to achieve cross-origin isolation without deploying complex security headers, and adds Ed25519 cryptographic algorithm support to the Web Cryptography API.

Chrome’s dominance in the browser market, with approximately 65% worldwide market share across all platforms as of 2024, means these security enhancements will impact billions of users globally.

The integration of on-device AI represents a paradigm shift in browser security, moving from reactive blocklist-based defenses to proactive, intelligent threat detection.

This release demonstrates Google’s commitment to leveraging artificial intelligence for cybersecurity while maintaining user privacy through on-device processing, setting new standards for browser security in an era of increasingly sophisticated cyber threats.

Try in-depth sandbox malware analysis for your SOC team. Get ANY.RUN special offer only until May 31 -> Try Here