Google has confirmed a critical security flaw in Chrome that affects billions of users across Windows, Mac, Linux, and Android platforms.
The vulnerability, which could allow attackers to execute arbitrary code through specially crafted web pages, prompted an urgent update release to address the issue before widespread exploitation.
The security flaw tracked as CVE-2025-2476 has been classified as a critical use-after-free (UAF) memory vulnerability in Chrome’s Lens component.
It was discovered and reported by security researcher SungKwon Lee of Enki Whitehat on March 5, 2025.
This severe issue could potentially allow remote attackers to exploit heap corruption via specially crafted HTML pages.
Use-after-free vulnerabilities represent a particularly dangerous class of memory management flaws that occur when a program continues to reference memory after it has been freed.
In practical terms, when malicious data is introduced before memory consolidation occurs, attackers can potentially leverage this condition to execute arbitrary code on affected systems.
The MITRE Common Weakness Enumeration database characterizes use-after-free vulnerabilities as scenarios where memory is improperly reused after being released, potentially leading to system compromise.
Google’s AddressSanitizer, a memory error detection tool, is specifically designed to identify such flaws during development phases, highlighting their significance in modern browser security.
Successful exploitation of this vulnerability could allow attackers to execute arbitrary code with the same privileges as the logged-in user.
This means that depending on the user’s permission level, attackers could potentially:
The vulnerability affects Chrome versions before 134.0.6998.117/.118 on Windows and Mac and 134.0.6998.117 on Linux platforms.
While no active exploitation has been confirmed in the wild, Google’s critical rating underscores the urgency of users updating immediately.
On March 19, 2025, Google released security updates to address the vulnerability. The stable channel has been updated to version 134.0.6998.117/.118 for Windows and Mac and 134.0.6998.117 for Linux users.
The Extended Stable channel has also been updated to version 134.0.6998.89 for Windows and Mac systems.
Google has implemented a standard practice of restricting detailed vulnerability information until a majority of users have updated their browsers, providing a critical protection window for users to secure their systems.
Users are strongly advised to update their Chrome installations immediately by:
The update will roll out over the coming days and weeks, but users should not wait for automatic updates and should manually verify they are running the latest version, especially given the critical nature of this security issue.
Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try for Free
Hackers are actively probing AI systems, turning exposed gateways and agent tools into routes for…
Hackers are making some phishing pages harder to track by changing the code delivered to…
A cyber incident reportedly forced a British power plant to halt operations for about four…
Russian hackers have used a new backdoor called HOOKEDGE to target defense manufacturers, government bodies,…
TITAN ransomware is pairing file encryption with an ambitious claim: artificial intelligence that can sort…
A fake student resume is being used to place a remote-access tool on researchers’ Windows…