Google just released a security update for zero-day vulnerability in its Google Chrome browser which is tracked as CVE-2025-6554.
This zero-day vulnerability was caused by type confusion in the V8 engine of JavaScript and WebAssembly engine.
It allowed an attacker to perform arbitrary reads/writes by crafted HTML page as Stated by NIST in National Vulnerability Database (NVD). This was found in Google Chrome version prior to 138.0.7204.96.
This issue was due to improper type checking in V8 engine and it could be exploited to trigger arbitrary code execution and read/write memory out of bounds of the buffer.
These kinds of zero-day bugs are hacker’s favourite because no immediate fix is available to stop the exploitation. In real world scenarios, hackers use this bugs and install spyware in victim’s machine, download malicious files to victim’s machine or execute malicious code to harm users.
Affected Versions:
All versions prior to,
- Windows:
138.0.7204.96/.97 - macOS:
138.0.7204.92/.93 - Linux:
138.0.7204.96