Chrome Emergency Fix: Three High-Severity Flaws in WebGPU and V8 Engine Risk RCE

According to Google, a Stable Channel Update for Chrome Desktop (version 142.0.7444.134/.135) was released to address five vulnerabilities, including three high-severity flaws that could lead to memory corruption, sandbox escapes, or arbitrary code execution.

The first high-severity issue, CVE-2025-12725, is an out-of-bounds write in WebGPU reported on 9 September 2025 by an anonymous researcher and could allow a remote attacker to write beyond allocated memory, potentially causing browser crashes or arbitrary code execution in the GPU process.

The second high-severity vulnerability, CVE-2025-12726, was discovered by security researcher Alesandro Ortiz and reported on 25 September 2025, involving the Views component and insecure handling of widget or UI object references. The third high-severity flaw, CVE-2025-12727, affects V8 and was reported by the researcher known as “303f06e3” on 23 October 2025, with suspected ties to internal memory handling in the engine’s execution layer.

In addition to these, Google patched two medium-severity Omnibox flaws, CVE-2025-12728 and CVE-2025-12729, and users are advised to update Chrome by visiting Settings → Help → About Google Chrome.