Google on Monday released a fresh Chrome 137 update to address three vulnerabilities, including a high-severity bug exploited in the wild.
Tracked as CVE-2025-5419, the zero-day is described as an out-of-bounds read and write issue in the V8 JavaScript engine.
“Google is aware that an exploit for CVE-2025-5419 exists in the wild,” the internet giant’s advisory reads. No further details on the security defect or the exploit have been provided.
However, the company credited Clement Lecigne and Benoît Sevens of Google Threat Analysis Group (TAG) for reporting the issue.
TAG researchers previously reported multiple vulnerabilities exploited by commercial surveillance software vendors, including such bugs in Chrome. Flaws in Google’s browser are often exploited by spyware vendors and CVE-2025-5419 could be no different.
According to a NIST advisory, the exploited zero-day “allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page”. It should be noted that the exploitation of out-of-bounds defects often leads to arbitrary code execution.
The latest browser update also addresses CVE-2025-5068, a medium-severity use-after-free in Blink that earned the reporting researcher a $1,000 bug bounty. No reward will be handed out for the zero-day.
The latest Chrome iteration is now rolling out as version 137.0.7151.68/.69 for Windows and macOS, and as version 137.0.7151.68 for Linux.
The patch for CVE-2025-5419 comes after a Chrome sandbox escape (CVE-2025-2783) exploited by a Russian state-sponsored group was caught and patched in March. Firefox too was patched against a similar vulnerability.
In mid-May, Google released a Chrome 136 update and warned that an exploit for one of the addressed bugs existed in the wild. The patch came roughly one week after a security researcher had released information on the flaw on X.
Related: Chrome 137, Firefox 139 Patch High-Severity Vulnerabilities
Related: Chrome to Distrust Chunghwa Telecom and Netlock Certificates
Related: Chrome 136 Update Patches Vulnerability With ‘Exploit in the Wild’
Related: Google Tracked 75 Zero-Days in 2024
