Google patches actively exploited flaw in Chrome
Take action: One more urgent patch for Chrome - Google is again patching an actively exploited flaw in Chrome, and exploitation is just a visit to a malicious site. DONT WAIT! Patch all your Chrome and Chromium browsers (Edge, Opera, Brave, Vivaldi...). Updating the browser is easy, all your tabs reopen after the patch.
Learn More
Google has released security updates to patch an actively exploited vulnerability in Chrome browser. This is the fourth zero-day flaw discovered in Chrome since the beginning of 2025
The vulnerability is tracked as CVE-2025-6554 (CVSS score 8.1) - a type confusion flaw in Chrome's V8 JavaScript and WebAssembly engine that allows remote attackers to perform arbitrary read and write operations through malicious HTML pages.
Type confusion vulnerabilities enable attackers to trick the browser into misinterpreting memory types, leading to remote code execution, sandbox escape, and full system compromise.
The security flaw was discovered and reported by Clément Lecigne of Google's Threat Analysis Group (TAG) on June 25, 2025. Google's TAG typically investigates serious threats like government-backed attacks. So it's possible the flaw is being exploited in targeted and potentially state-sponsored operations.
Google has released the security patches in Chrome versions 138.0.7204.96/.97 for Windows, 138.0.7204.92/.93 for Mac, and 138.0.7204.96 for Linux, which are being rolled out over the coming days and weeks. Users are strongly advised to update their Chrome browser ASAP
As with typical Google security practices, detailed exploit information is being withheld until a majority of users have applied the security update, preventing potential misuse by malicious actors while the vulnerability remains unpatched on many systems.
