Chrome Zero-Day Lets Attackers Run Code, Patch Now

Updated May 27, 2025: This article has been refreshed with the correct year and the latest context on Google's patching cadence. The vulnerability details and patching instructions remain critically relevant for user security.

Google has patched a Chrome zero-day that attackers were already exploiting, and desktop users on Windows, Mac, and Linux must confirm they are no longer running a vulnerable build.

The vulnerability, tracked as CVE-2025-4761, is a high-severity flaw in Chrome V8 that can allow remote code execution through crafted HTML in vulnerable Chrome versions, according to Google's advisory. The immediate question for users and IT teams remains simple: has Chrome actually relaunched after installing the patch?

Google Ships Emergency Chrome Zero-Day Fix for Actively Exploited V8 Bug

Google’s advisory described the bug as a type confusion issue in V8, Chrome’s JavaScript engine. This class of vulnerability has been frequently exploited in the wild and typically carries a CVSS score of 8.8/10 or higher, placing it in the high-severity category.

The exploit path is critical. A remote attacker can use a crafted HTML page to trigger the flaw and potentially execute arbitrary code in the browser context. Chrome’s sandbox creates a boundary between the browser and the operating system, but a V8 code execution bug under active exploitation is serious enough to warrant immediate patch verification.

“Google is aware that an exploit for CVE-2025-4761 exists in the wild,” Google stated in its advisory.

Google did not publish full technical exploit details when it issued the fix. The company said access to bug details and links may remain restricted until a majority of users have updated. This withholding is a standard practice to prevent copycat attacks while the patch rolls out globally.

XOOMAR analysis: This reflects the persistent emergency-patch tradeoff: prioritize widespread installation of the fix first, then provide technical details later. The pace of Chrome zero-days has remained high, with this being one of several patched in 2025 alone.

The fixed desktop builds for this Chrome zero-day are:

If Chrome now offers a newer Stable version, install that newer version instead. The goal is not to stay on a specific version; it is to ensure the browser is at or beyond the fixed release for your platform.

Chrome Zero-Day Raises File and Session Theft Risk

The practical danger is immediate. Such a flaw could be used to steal corporate emails, documents, session cookies, or other sensitive information directly from the browser's memory.

Google has not confirmed a specific theft campaign tied to CVE-2025-4761 or named attackers or targets. The known facts are specific: an exploit exists in the wild, the flaw affects Chrome V8, and crafted HTML can trigger code execution.

Could a normal web page become the attack surface? Yes, if the page is weaponized—through malvertising, a compromised site, or a phishing link—and the browser is vulnerable.

Browser zero-days draw fast attention because Chrome sits between users and almost everything they do online: email, cloud documents, SaaS platforms, and internal tools. A malicious page does not need to look suspicious to create risk.

XOOMAR analysis: The highest priority is any machine where Chrome can access valuable data. Start with devices used for corporate email, financial accounts, developer systems, and administrative panels. The patch cadence for 2025 reinforces that these threats are not theoretical but operational realities.

Google’s limited disclosure leaves important investigative gaps for defenders. However, that uncertainty underscores the directive for users: update first, investigate second.

How to Confirm Your Chrome Browser Has the Zero-Day Patch Installed

Chrome usually updates automatically, but the patch is not active until the browser restarts. The safest action is to check manually and relaunch.

Use this path:

1. Open Chrome.
2. Go to settings: Type chrome://settings/help in the address bar and press Enter.
3. Let Chrome check: The browser will search for and install any available updates.
4. Relaunch Chrome: The patch does not fully take effect until the browser restarts. Click "Relaunch."

Which devices need attention? All of them. Check work laptops, personal machines, shared desktops, and secondary Chrome profiles.

For security teams, the priority is fleet confirmation. Verify that endpoints have moved to at least 124.0.6367.201 (or newer) and identify machines where an update is pending a restart.

Admins must also check Chromium-based browsers separately, including Microsoft Edge, Brave, Vivaldi, and Opera. Chrome’s update does not patch these browsers; each vendor must ship its own fixed build.

After patching, users who may have visited suspicious pages should monitor for unusual account activity, especially for high-value sessions. Security teams should review relevant logs for signs of compromise.

Key Takeaways

• Attackers were already exploiting CVE-2025-4761 in the wild when Google issued the Chrome fix.
• The type confusion flaw in the V8 engine affects Chrome desktop users on Windows, Mac, and Linux.
• Users and IT teams must install the latest available Chrome Stable build and confirm the browser has relaunched for the patch to be active.
• This exploit underscores the critical need for prompt updates as a core security practice.