Google fixes critical Chrome flaw, researcher earns $43K

Google has fixed a critical use-after-free vulnerability in its Chrome browser that could potentially lead to code execution, tracked as CVE-2025-10200, with a Chrome update addressing this issue alongside another flaw, CVE-2025-10201. The update, released for Windows, macOS and Linux, carries Chrome version numbers 140.0.7339.127/.128 on Windows, 140.0.7339.132/.133 on macOS, and 140.0.7339.127 for Linux.

The flaw was reported by Looben Yang on 22 August 2025, and Google also acknowledged another bug in the same update, CVE-2025-10201, which relates to an inappropriate implementation in Mojo, the inter-process communication framework used by Chrome. Researchers Sahan Fernando and an anonymous expert reported CVE-2025-10201 and earned $30,000 from Google for their findings. Google noted that it did not reveal whether any of these vulnerabilities had been actively exploited in the wild.