Google Fixes Fourth Actively Exploited Chrome Zero-Day of 2025

Google has released an urgent security update for its Chrome browser, addressing a critical zero-day vulnerability that is actively being exploited in the wild. This marks the fourth such actively exploited flaw patched by the tech giant in 2025, highlighting the persistent threat posed by sophisticated cyberattacks.

The vulnerability, identified as CVE-2025-6554, is a high-severity type confusion bug within Chrome’s V8 JavaScript and WebAssembly engine. This flaw allows remote attackers to perform arbitrary read and write operations simply by enticing users to visit a maliciously crafted HTML page. Such vulnerabilities can lead to unexpected browser behavior, including crashes, and, more critically, arbitrary code execution on the affected system.

Clément Lecigne of Google’s Threat Analysis Group (TAG) discovered and reported the flaw on June 25, 2025. TAG is renowned for uncovering and investigating highly targeted attacks, often linked to nation-state actors or commercial surveillance operations. The involvement of TAG suggests that this zero-day may have been leveraged in sophisticated, high-profile campaigns.

Google swiftly responded to the threat, implementing an immediate mitigation on June 26, 2025, via a configuration change pushed to all stable channel users. The full patch, however, requires users to update their Chrome browsers to the latest versions. The stable channel update brings Chrome to version 138.0.7204.96/.97 for Windows users, 138.0.7204.92/.93 for Mac systems, and 138.0.7204.96 for Linux platforms. The rollout is ongoing and will reach users over the coming days and weeks.

While Google has not yet disclosed specific technical details or attributed the ongoing attacks, the active exploitation underscores the immediate need for users to update their browsers. Zero-day vulnerabilities, by definition, are flaws unknown to vendors until they are exploited, making immediate patching crucial to protect against potential data exfiltration, spyware installation, or full system compromise.

This incident serves as a stark reminder for individuals and organizations alike to prioritize browser security. Users are strongly advised to update their Chrome browsers immediately by navigating to Settings > Help > About Google Chrome, which should automatically trigger the update. For organizations, ensuring timely patch compliance and enabling automated updates across all endpoints is paramount to mitigating such significant risks in the evolving cyber threat landscape.