Google has released an urgent security update for Chrome to address two significant vulnerabilities, including a critical remote code execution flaw that could allow attackers to completely compromise user systems.
The stable channel update brings Chrome to version 140.0.7339.127/.128 for Windows, 140.0.7339.132/.133 for Mac, and 140.0.7339.127 for Linux.
The most severe issue fixed in this update is CVE-2025-10200, a critical use-after-free vulnerability in Chrome’s ServiceWorker component.
This flaw carries the highest severity rating and earned security researcher Looben Yang a substantial $43,000 bounty for the discovery.
Use-after-free vulnerabilities occur when programs continue to use memory after it has been freed, potentially allowing attackers to execute malicious code remotely.
ServiceWorkers are background scripts that enable web applications to function offline and handle network requests.
| CVE Number | Severity | Vulnerability Type | Bounty |
| CVE-2025-10200 | Critical | Use After Free | $43,000 |
| CVE-2025-10201 | High | Inappropriate Implementation | $30,000 |
A vulnerability in this component poses significant risks as it operates with elevated privileges and can affect how web pages interact with the browser’s core functionality.
The flaw was reported on August 22, 2025, demonstrating Google’s commitment to rapid vulnerability disclosure and patching.
The second vulnerability, CVE-2025-10201, affects Chrome’s Mojo inter-process communication system and received a high severity rating.
Security researchers Sahan Fernando and an anonymous contributor discovered this inappropriate implementation flaw, earning a combined $30,000 reward.
Mojo facilitates secure communication between different Chrome processes, making vulnerabilities in this system particularly concerning for browser security architecture.
Inappropriate implementation vulnerabilities typically involve incorrect handling of security boundaries or improper validation of data passing between system components.
While not as immediately exploitable as use-after-free flaws, these issues can still lead to privilege escalation or security bypass scenarios.
Chrome’s security team emphasizes that the update will roll out gradually over the coming days and weeks to ensure stability across the massive user base.
The company maintains its policy of restricting access to detailed vulnerability information until most users receive the security patches, preventing potential exploitation during the update period.
Google continues leveraging advanced detection tools including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL to identify security issues during development.
This proactive approach helps prevent vulnerabilities from reaching stable releases.
Users should immediately update their Chrome browsers through the Help menu’s “About Google Chrome” option to ensure protection against these critical security flaws.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
Attackers abused compromised ConnectWise Cloud Backup credentials to access Microsoft 365 customer environments, prompting ConnectWise…
Anthropic says an internal Claude research model reconstructed how the National Security Agency generated seeds…
Two WordPress Core vulnerabilities can be chained to execute remote code without authentication, according to…
A newly disclosed OpenBSD kernel exploitation chain combines a shared memory accounting flaw with a…
GhostAction attackers have expanded their GitHub credential theft campaign with a second stage that disguises…
Indian authorities have warned that SideCopy hackers are targeting Indian organizations, including academic institutions, with…