Google Patches Actively Exploited Chrome Zero-Day Flaw (CVE-2025-13223) in Emergency Update

Google has issued an urgent, out-of-band update for the Chrome Stable channel to address two V8 engine vulnerabilities, with the most serious being CVE-2025-13223, a zero-day flaw that is already being actively exploited in the wild. According to Google’s Threat Analysis Group (TAG), the flaw is a Type Confusion in V8 that could allow heap corruption and arbitrary code execution, making it a severe drive-by attack risk.

The patch also covers CVE-2025-13224, another High-severity Type Confusion bug in the V8 engine, for which there is no current public confirmation of active exploitation. Google is restricting access to bug details to give users time to update, and the patch is rolling out over the coming days/weeks; users should not wait for the automatic update.

All Chrome users on Windows, Mac and Linux are advised to update to the new stable versions: 142.0.7444.175/176 (Windows), 142.0.7444.176 (Mac), and 142.0.7444.175 (Linux). To ensure protection, open Chrome, go to the three-dot menu, select Help then About Google Chrome, and relaunch after the update is downloaded.