Chrome 140 Released, Patches Critical (CVE-2025-10200) and High-Severity (CVE-2025-10201) Vulnerabilities

Google has issued a Stable channel update for Chrome on Windows, Mac and Linux, bringing the browser to versions 140.0.7339.127/.128 on Windows, 140.0.7339.132/.133 on Mac, and 140.0.7339.127 on Linux. The most severe flaw addressed is CVE-2025-10200, a critical use-after-free vulnerability in Chrome’s ServiceWorker component, with exploitation potentially allowing arbitrary code, privilege escalation or browser crashes; Google awarded a $43,000 bounty for this discovery, reflecting its high impact.

The second vulnerability, CVE-2025-10201, is rated high severity and relates to an inappropriate implementation in Mojo, Chrome’s inter-process communication system, with a potential to escape sandboxing or cause unexpected behaviour; Google awarded a $30,000 bounty for the reporting researchers. Chrome users on Windows, Mac and Linux are strongly advised to update to the latest versions immediately.