Google Chrome 136 Patch Fixes Critical Audio Vulnerability Enabling Remote Code Execution

Google has issued an urgent security update for its Chrome browser following the discovery of a critical vulnerability identified as CVE-2025-4372. This flaw, rated between 9.8 and 10 on the CVSS severity scale, lies within Chrome’s WebAudio API and stems from a ‘use-after-free’ memory issue. If exploited, it could allow attackers to remotely execute malicious code with minimal user interaction — simply visiting a malicious web page. The update brings Chrome to version 136.0.7103.92/.93 for Windows and Mac, and version 136.0.7103.87 for Android. Google acted quickly to patch the bug, though it has controversially rated the vulnerability as medium-severity, despite its potentially severe consequences. As of now, there’s no evidence of exploitation in the wild, but security experts warn this may not remain true for long. Users are urged to update their browsers immediately via the Help > About Google Chrome menu. The vulnerability does not require elevated user privileges to be triggered, making it an attractive target for cyber attackers. Google has also been addressing other security concerns this week, including a zero-click Android flaw and the use of deceptive captchas to steal Windows credentials. This latest incident underscores the importance of timely updates in maintaining cybersecurity.