Google on Tuesday announced patches for three vulnerabilities in Chrome 137, including two high-severity issues reported by external researchers.
The first of the externally reported bugs is CVE-2025-6191, described as an integer overflow defect in the V8 JavaScript engine. Google says it handed out a $7,000 reward to the reporting researcher.
The second flaw, tracked as CVE-2025-6192, is a use-after-free vulnerability in Chrome’s Profiler component that earned the reporting researcher a $4,000 reward.
The security defects were addressed in Chrome versions 137.0.7151.119/.120 for Windows and macOS, and in version 137.0.7151.119 for Linux.
Memory bugs in Chrome are attractive targets for attackers, as they can potentially lead to remote code execution, and users are advised to update their browsers as soon as possible, although Google makes no mention of any of these issues being exploited.
However, threat actors have been observed targeting recent Chrome vulnerabilities in the wild, some of which were exploited as zero-days, before being caught by security researchers.
One example is CVE-2025-2783, a high-severity sandbox escape flaw flagged by Kaspersky as being exploited in one-click attacks in a cyberespionage campaign targeting various Russian organizations. Firefox was found vulnerable to a similar defect.
While Kaspersky did not attribute the observed zero-day attacks to a specific threat actor, Positive Technologies this week reported that a group tracked as Team46 was behind them.
The zero-day exploitation, the company says, led to the deployment of Trinper, a backdoor associated with the TaxOff hacking group, suggesting that Team46 and TaxOff represent a cluster of activity that can be attributed to a single adversary.
“This group leverages zero-day exploits, which enables it to penetrate secure infrastructures more effectively. The group also creates and uses sophisticated malware, implying that it has a long-term strategy and intends to maintain persistence on the compromised systems for an extended period,” Positive Technologies notes.
Related: Chrome, Firefox Updates Resolve High-Severity Memory Bugs
Related: Google Researchers Find New Chrome Zero-Day
Related: Chrome to Distrust Chunghwa Telecom and Netlock Certificates
Related: Chrome 137, Firefox 139 Patch High-Severity Vulnerabilities
