This report was translated by AI; nobody has reviewed the translation yet. Original language: Czech.
[TLP:CLEAR] Google Chrome fixes 6 vulnerabilities
Google fixes 6 vulnerabilities in Google Chrome. The fix is available in version 139.0.7258.127/.128 for Windows and macOS. It will also be available in version 139.0.7258.127 for Linux in the coming days/weeks. The most severe vulnerabilities are listed below; the remaining ones can be found at [1].
An unauthenticated remote attacker, due to a heap buffer overflow vulnerability in libaom, is able to execute arbitrary code [1][2].
The vulnerability is present in product:
- Google Chrome; <139.0.7258.127
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-8879 at cve.org, NVD
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 12. 8. 2025.
An unauthenticated remote attacker, due to a race condition vulnerability in V8, is able to execute arbitrary code inside the sandbox by means of a modified HTML page [1][3].
The vulnerability is present in product:
- Google Chrome; <139.0.7258.127
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-8880 at cve.org, NVD
- CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') at cwe.mitre.org
The vulnerability was publicly disclosed 12. 8. 2025.
An unauthenticated remote attacker, due to an out-of-bounds write vulnerability in the ANGLE component, is able to perform an out-of-bounds memory access by means of a crafted HTML page [1][4].
The vulnerability is present in product:
- Google Chrome; <139.0.7258.127
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-8901 at cve.org, NVD
- CWE-787: Out-of-bounds Write at cwe.mitre.org
The vulnerability was publicly disclosed 12. 8. 2025.
Links
By CESNET, z.s.p.o. Michaela Jarošová on 18. 8. 2025.