Chrome zero-day under active attack: visiting the wrong site could hijack your browser

According to Google, Chrome has a zero-day under active attack after researchers found two high‑severity flaws in the browser’s V8 engine, the component that runs JavaScript in Chrome and other Chromium-based browsers. The flaws are type confusion defects that can allow a remote attacker to run arbitrary code through a crafted HTML page, meaning simply visiting a malicious or compromised site could hijack your browser.

One vulnerability, CVE-2025-13223, is reported to be exploited in the wild and was discovered by Google’s Threat Analysis Group, while the second, CVE-2025-13224, was found by Google’s Big Sleep and is believed to have similar potential impact. Google has released an update bringing Chrome to version 142.0.7444.175 or later for Windows, 142.0.7444.175/176 for macOS, and 142.0.7444.175 for Linux, with both flaws addressed.

With Chrome used by an estimated 3.4 billion people, users are urged to install the patches promptly and ensure automatic updates are enabled to mitigate the risk, as attackers could exploit unpatched browsers during web browsing.