Chrome 140 Patches Six Vulnerabilities, Including High-Severity V8 Flaw (CVE-2025-9864)

Google has released Chrome 140 on the stable channel for Windows, macOS and Linux, with builds 140.0.7339.80 (Linux) and 140.0.7339.80/81 (Windows and Mac) rolling out over the coming days and weeks. The update patches six security vulnerabilities, including a high-severity use-after-free flaw in the V8 JavaScript engine, CVE-2025-9864, reported by Pavel Kuzmin of Yandex Security Team, which could potentially allow arbitrary code execution in the browser.

In addition, medium-severity issues were fixed in components such as the Toolbar (CVE-2025-9865), Extensions (CVE-2025-9866) and Downloads (CVE-2025-9867), all reported through Chrome’s bug bounty programme, with rewards ranging from $1,000 to $5,000. Google reminded users that access to bug details may be restricted until a majority of users are updated with a fix. Chrome updates will roll out automatically, but users are encouraged to manually check for updates to ensure they are running the latest secure version.