This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.
[TLP:CLEAR] Google Chrome fixes 4 vulnerabilities
Google fixes 4 vulnerabilities in Google Chrome as well as in Chromium-based web browsers. Google has fixed the vulnerabilities in version 140.0.7339.185 for Chrome on Linux (available in the coming days) and in version 140.0.7339.185/.186 for Chrome on Windows/Mac [1]. Microsoft has not yet released a fix for Edge, but is working on it [2]. Further details on these vulnerabilities have not yet been published due to responsible disclosure.
An unauthenticated remote attacker can abuse a pointer to memory that has already been freed, which may cause an application crash, unauthorized modification of data in memory or potentially code execution [1].
The vulnerability is present in products:
- Windows:Google Chrome; >=140, <140.0.7339.185;
- Mac:Google Chrome; >=140, <140.0.7339.185;
- Linux:Google Chrome; >=140, <140.0.7339.185;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-10500 at cve.org, NVD
- CVE-2025-10501 at cve.org, NVD
- CWE-416: Use After Free at cwe.mitre.org
The vulnerability was publicly disclosed 17. 9. 2025.
An unauthenticated remote attacker can access memory beyond the allocated boundary, which may cause an application crash, unauthorized modification of data in memory or, under certain circumstances, code execution [1].
The vulnerability is present in products:
- Windows:Google Chrome; >=140, <140.0.7339.185;
- Mac:Google Chrome; >=140, <140.0.7339.185;
- Linux:Google Chrome; >=140, <140.0.7339.185;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-10502 at cve.org, NVD
- CWE-122: Heap-based Buffer Overflow at cwe.mitre.org
The vulnerability was publicly disclosed 17. 9. 2025.
An unauthenticated remote attacker can make memory be handled as a different variable type than originally intended, which may cause an application crash, unauthorized modification of data in memory or, under certain circumstances, code execution. Google warns of active exploitation of this vulnerability [1].
The vulnerability is present in products:
- Windows:Google Chrome; >=140, <140.0.7339.185;
- Mac:Google Chrome; >=140, <140.0.7339.185;
- Linux:Google Chrome; >=140, <140.0.7339.185;
CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
More information:
- CVE-2025-10585 at cve.org, NVD
- CWE-843: Access of Resource Using Incompatible Type ('Type Confusion') at cwe.mitre.org
The vulnerability was publicly disclosed 17. 9. 2025.
Links
By CESNET, z.s.p.o. Martin Krajči on 19. 9. 2025.