Google has issued a security update for Chrome desktop to address CVE-2025-5419, which has a CVSS score of 8.8. It is a critical zero-day flaw in the V8 JavaScript engine that is actively exploited by attackers. Continue to read this Cybersecurity Threat Advisory to learn how to keep your environment safe.
What is the threat?
CVE-2025-5419 is an out-of-bounds read and write issue in the V8 JavaScript and WebAssembly engine. Using a maliciously crafted HTML page, threat actors can exploit this vulnerability, giving remote attackers to achieve heap corruption. This type of vulnerability can cause memory corruption, potentially allowing attackers to execute arbitrary code within the browser, posing a significant risk to the user’s system.
Why is this noteworthy?
Google addressed this zero-day vulnerability within 24 hours, highlighting the severity of this flaw. Furthermore, Google disclosed that they are aware of active exploitation attempts targeting this flaw. Chrome depends on the security of components like the V8 engine to provide fast and secure web experiences. V8’s design for high-speed JavaScript execution, combined with its complexity and close interaction with low-level memory, makes it a prime target for attackers.
What is the exposure or risk?
Commercial spyware vendors have exploited similar vulnerabilities in the past, and CVE-2025-5419 may follow the same pattern. As surveillance tools frequently target Chrome, this issue presents a significant risk for user privacy and security.
What are the recommendations?
Barracuda recommends the following actions to secure your environment:
- Update to Chrome version 137.0.7151.68/.69 on Windows and macOS, and version 137.0.7151.68 on Linux to protect against potential security threats.
- Update Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi.
References
For more in-depth information about the recommendations, please visit the following links:
- https://cyberinsider.com/google-patches-actively-exploited-zero-day-in-chromes-v8-engine/
- https://www.securityweek.com/google-researchers-find-new-chrome-zero-day/
- https://thehackernews.com/2025/06/new-chrome-zero-day-actively-exploited.html
If you have any questions about this Cybersecurity Threat Advisory, don’t hesitate to get in touch with Barracuda Managed XDR’s Security Operations Center.
