Google Releases Critical Patch for Vulnerability in Chrome’s JavaScript Engine

Google has issued an emergency patch for a critical security flaw in Chrome, identified as CVE-2025-6554. This vulnerability, discovered in the V8 JavaScript and WebAssembly engine, allowed attackers to execute arbitrary read and write operations by tricking users into visiting specially crafted websites. According to Google, the vulnerability was actively being exploited in the wild. The flaw was first reported by Clément Lecigne from Google’s Threat Analysis Group (TAG) on June 25, 2025. It affects Chrome versions prior to 138.0.7204.96 and could lead to arbitrary code execution or program crashes. A fix was deployed on June 26, affecting Chrome users across Windows, macOS, and Linux platforms. The vulnerability is categorized as a ‘type confusion’ error, which occurs when a program incorrectly assumes the type of an object, allowing attackers to access memory out of bounds. This can lead to various malicious activities, such as spyware installation and data theft. The TAG team’s involvement suggests the flaw was part of targeted campaigns, possibly against high-profile individuals like journalists or dissidents. Google recommends users and organizations update their browsers immediately to ensure security. This is the fourth zero-day vulnerability addressed by Google in 2025.