What are the latest Chrome vulnerabilities that allow memory manipulation and code execution?

Key takeaways

• CVE-2025-8292 is a use-after-free bug in Chrome's Media Stream component that could allow code execution through a malicious website.
• The fix is in Chrome 138.0.7204.183 for Linux and 138.0.7204.183 or.184 for Windows and macOS.
• Open Settings, About Chrome and restart the browser to apply it.

What Happened in the Latest Chrome Update?

Google has released a critical security update for its Chrome browser, fixing multiple vulnerabilities. The most dangerous of them is a high-severity bug that allows attackers to manipulate memory and execute code on your system, all through just visiting a malicious website.

If you use Chrome on Windows, macOS, or Linux, updating immediately is strongly recommended.

Which Chrome Versions Are Affected?

The vulnerabilities were fixed in:

• Chrome 138.0.7204.183 for Linux

• Chrome 138.0.7204.183/.184 for Windows and macOS

If you are running older versions, your browser is exposed to remote attacks.

What Is CVE-2025-8292 and Why Is It Dangerous?

The most severe vulnerability fixed is CVE-2025-8292, categorized as a “use-after-free” bug in the Media Stream component of Chrome.

This kind of vulnerability happens when a program frees (releases) memory but continues to use it afterward. If an attacker crafts a special HTML page and you visit it:

• Chrome could crash, or worse,

• The attacker could run malicious code on your machine,

• They could steal data, install malware, or even create new user accounts with full control.

A security researcher reported this bug to Google on June 19, 2025, and received an $8,000 reward through the Chrome Vulnerability Reward Program.

Why Is Google Not Sharing Full Details Yet?

To prevent attackers from using this bug before most users update, Google is holding back the full technical details. This is a common practice in the cybersecurity world to reduce the risk of zero-day attacks.

How Is Chrome Handling Security This Year?

Chrome has faced a series of memory-related bugs and high-severity issues in version 138:

• CVE-2025-6558 – a zero-day exploit targeting the ANGLE and GPU components.

• Type Confusion bugs in V8 JavaScript engine

• Other memory corruption issues

Google is using advanced security tools like:

• AddressSanitizer (ASan)

• MemorySanitizer

• Internal audits

• Fuzzing to simulate random actions that might cause bugs

These tools help Google discover and fix bugs before they’re exploited in the wild.

Why Should You Care?

These bugs allow attackers to:

• Gain full access to your system

• Bypass Chrome’s sandbox protections

• Steal your login credentials, banking info, and private data

If you're using an outdated version of Chrome, you are at serious risk, especially from drive-by downloads or phishing links.

How to Update Chrome Manually

To check and update your browser:

1. Open Chrome

2. Click the three-dot menu on the top right

3. Go to Help → About Google Chrome

4. Chrome will automatically check and install updates

5. Restart your browser to apply changes

Chrome Vulnerability Update (July 2025)

Conclusion: Update Immediately

Cyberattacks are getting smarter, and vulnerabilities like these are easy targets for attackers. Chrome is one of the most-used browsers globally, making it a prime target.

If you're using Chrome, whether for personal browsing or business, update right now to protect yourself from memory manipulation, data theft, and unauthorized access.

Related reading

• CVE-2025-6554 | Chrome 0-Day Vulnerability Exploited to Run Arbitrary Code – Patch Now!
• CISA Chrome 0-Day Vulnerability (CVE-2025-6554) | Exploit Warning, Fixes, and Mitigation Guide
• What are the critical vulnerabilities fixed in Firefox 141 and why should you update immediately?

Reference

For the authoritative details, see National Vulnerability Database.