**Google Patches Actively Exploited Chrome Zero-Day (CVE-2025-5419)**
Google has released emergency patches for three Chrome vulnerabilities, including CVE-2025-5419, a critical zero-day flaw actively exploited in the wild. The vulnerability, classified as an out-of-bounds read/write issue in Chrome’s V8 JavaScript and WebAssembly engine, allows remote attackers to trigger heap corruption via maliciously crafted HTML pages. If exploited, the flaw could enable arbitrary code execution or sandbox escapes, posing severe risks to users.
The vulnerability affects Chrome versions prior to 137.0.7151.68 and impacts all Chromium-based browsers, including Microsoft Edge, Opera, and others. The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2025-5419 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming active exploitation. While Google has not disclosed specific attack details, the company acknowledged the threat and urged users to update immediately.
Google deployed an initial mitigation via a configuration update on May 28, 2025, followed by full patches in Chrome 137.0.7151.68/.69 (Windows/Mac) and 137.0.7151.68 (Linux). This marks the third actively exploited Chrome zero-day in 2025, highlighting the escalating threat landscape for web browsers.
The incident aligns with findings from Mandiant’s M-Trends 2025 Report, which identified vulnerability exploitation as the top initial access vector in 2024, underscoring the need for proactive defense strategies against zero-day threats.
Source: https://socprime.com/blog/cve-2025-5419-zero-day-vulnerability/
Google cybersecurity rating report: https://www.rankiteo.com/company/google
"id": "GOO1766735842",
"linkid": "google",
"type": "Vulnerability",
"date": "6/2025",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'customers_affected': 'Millions of users globally',
'industry': 'Technology',
'location': 'Global',
'name': 'Google Chrome',
'type': 'Software'},
{'industry': 'Technology',
'location': 'Global',
'name': 'Microsoft Edge',
'type': 'Software'},
{'industry': 'Technology',
'location': 'Global',
'name': 'Opera',
'type': 'Software'}],
'attack_vector': 'Maliciously crafted HTML page',
'date_detected': '2025-05-28',
'date_resolved': '2025-05-28',
'description': 'A new critical zero-day vulnerability (CVE-2025-5419) in '
"Chrome's V8 JavaScript and WebAssembly engine allows remote "
'attackers to trigger heap corruption via maliciously crafted '
'HTML pages. The flaw has been actively exploited in the wild, '
'affecting Chrome versions prior to 137.0.7151.68 and other '
'Chromium-based browsers. Google issued emergency patches to '
'mitigate the threat.',
'impact': {'operational_impact': 'Potential arbitrary code execution or '
'browser sandbox escape',
'systems_affected': 'Chrome versions prior to 137.0.7151.68, '
'Microsoft Edge, Opera, and other '
'Chromium-based browsers'},
'investigation_status': 'Ongoing (specific attack details withheld until more '
'users apply the update)',
'lessons_learned': 'The growing prevalence of zero-day vulnerabilities and '
'their exploitation highlights the need for more proactive '
'defense strategies and future-proof cybersecurity '
'toolkits.',
'post_incident_analysis': {'corrective_actions': 'Emergency patches and '
'configuration updates to '
'mitigate heap corruption',
'root_causes': 'Out-of-bounds memory access in '
'Chrome’s V8 JavaScript and '
'WebAssembly engine'},
'recommendations': 'Organizations should leverage platforms like SOC Prime '
'for actionable threat intelligence, detection content, '
'and proactive defense against zero-day vulnerabilities. '
'Regularly update software and monitor for emerging '
'threats.',
'references': [{'source': 'Google Advisory'},
{'source': 'CISA KEV Catalog'},
{'source': 'Mandiant’s M-Trends 2025 Report'}],
'regulatory_compliance': {'regulatory_notifications': 'Added to CISA’s '
'Exploited '
'Vulnerabilities (KEV) '
'Catalog'},
'response': {'communication_strategy': 'Vendor advisory confirming active '
'exploitation',
'containment_measures': 'Configuration update and emergency '
'patches',
'remediation_measures': 'Chrome versions 137.0.7151.68/.69 for '
'Windows and Mac, 137.0.7151.68 for '
'Linux'},
'title': 'CVE-2025-5419 Chrome Zero-Day Exploitation',
'type': 'Zero-Day Exploitation',
'vulnerability_exploited': 'CVE-2025-5419'}