Multiple Chrome High-Severity Vulnerabilities Let Attackers Execute Arbitrary Code
\n \t
\n
<\/BR>
\n
\n \t
\n
<\/BR><\/p>\n
Google Chrome has released a critical security update addressing six vulnerabilities that could potentially enable arbitrary code execution on affected systems.\u00a0<\/p>\n
The stable channel update to version 139.0.7258.127\/.128 for Windows and Mac, and 139.0.7258.127 for Linux, contains patches for multiple high-severity security flaws that pose significant risks to user data and system integrity.<\/p>\n
Key Takeaways<\/mark><\/strong>
1. Chrome fixes six vulnerabilities, including three that enable code execution.
2. Affects V8 engine and graphics - allows malicious code execution.
3. Update Chrome now via Settings > About Chrome.<\/pre>\nHigh-Severity Vulnerabilities Addressed<\/strong><\/h2>\n
The security update targets three high-severity vulnerabilities<\/a> that could lead to arbitrary code execution.\u00a0<\/p>\n
CVE-2025-8879 represents a heap buffer overflow vulnerability<\/a> in the libaom library, which handles video encoding and decoding operations.\u00a0<\/p>\n
This type of vulnerability allows attackers to write data beyond allocated memory boundaries, potentially overwriting critical system information.<\/p>\n
CVE-2025-8880 addresses a race condition in Google\u2019s V8 JavaScript engine, reported by security researcher Seunghyun Lee.\u00a0<\/p>\n
Race conditions occur when multiple processes attempt to access shared resources simultaneously, creating unpredictable behavior that attackers can exploit.\u00a0<\/p>\n
The third high-severity flaw, CVE-2025-8901, involves an out-of-bounds write vulnerability in ANGLE (Almost Native Graphics Layer Engine), which translates OpenGL ES API calls to hardware-supported APIs.<\/p>\n
Chrome\u2019s security team utilized multiple advanced detection methodologies to identify these vulnerabilities, including AddressSanitizer for detecting memory corruption bugs, MemorySanitizer for uninitialized memory reads, and UndefinedBehaviorSanitizer for catching undefined behavior in C\/C++ code.\u00a0<\/p>\n
The update also incorporates Control Flow Integrity mechanisms and findings from libFuzzer and AFL (American Fuzzy Lop) testing frameworks.<\/p>\n
Medium- Severity Vulnerabilities Addressed<\/strong><\/h2>\n
Additional medium-severity vulnerabilities were also patched, including CVE-2025-8881, which addresses inappropriate implementation in the File Picker component, and CVE-2025-8882, a use-after-free vulnerability in the Aura windowing system.\u00a0<\/p>\n
Use-after-free vulnerabilities occur when programs continue to use memory after it has been freed, leading to potential code execution opportunities.<\/p>\n
\n