Critical Chrome Use-After-Free Flaw Enables Arbitrary Code Execution

Google has released an urgent security update for the Chrome Stable channel to address a critical use-after-free vulnerability in the ANGLE graphics library that could allow attackers to execute arbitrary code on vulnerable systems, according to Google. The flaw, tracked as CVE-2025-9478, was discovered by the Google Big Sleep team on 11 August 2025 and resides in ANGLE, which translates OpenGL ES calls to native graphics API calls across desktop and mobile platforms.

The fixes apply to Chrome Stable versions 139.0.7258.154 and .155 on Windows and macOS, and 139.0.7258.154 on Linux, with a rollout that will happen automatically over the coming days and weeks. A malicious website exploiting this vulnerability could trigger a use-after-free condition, potentially enabling remote code execution and allowing attackers to install malware, steal data, or pivot deeper into networks in drive-by download scenarios.

Mitigation steps include updating to the latest Stable builds and, for large deployments, pushing version 139.0.7258.154/.155, alongside guidance to monitor unusual WebGL or graphics API activity and enforce least-privilege principles.