Google Chrome Vulnerabilities Expose Users to Data Theft and Crashes

Google has released Chrome Stable channel version 140.0.7339.207/.208 for Windows and Mac, and 140.0.7339.207 for Linux, addressing three high-severity vulnerabilities in its V8 JavaScript engine that could expose sensitive information or lead to system crashes.

This update will roll out over the coming days and weeks.

Critical Side-channel Leak in V8

The most severe issue, tracked as CVE-2025-10890, is a side-channel information leak within V8 that can allow an attacker to infer data from memory they should not be able to access.

Reported by Mate Marjanović of SharpEdged on July 9, 2025, this vulnerability exploits subtle timing differences to reconstruct sensitive information, such as cryptographic keys or user credentials.

Although exploitation requires a malicious web page or script, once triggered, the bug can silently exfiltrate data at high speed without crashing the renderer process.

Google’s V8 team employed a range of sanitizers and fuzzers during development and post-release testing, including AddressSanitizer, MemorySanitizer, and libFuzzer, to detect and eliminate speculative execution and boundary-checking errors.

However, side-channel leaks remain notoriously difficult to eradicate, necessitating ongoing vigilance.

Integer Overflows Could Lead to Crashes

Two additional high-severity integer overflow flaws, CVE-2025-10891 and CVE-2025-10892, were disclosed by the Google Big Sleep research group on September 9 and 10, 2025, respectively.

Both bugs reside in V8’s internal parsing routines, where malformed input can cause arithmetic operations to wrap around unexpectedly.

Successful exploitation may allow attackers to craft JavaScript payloads that crash the browser or, in some configurations, achieve arbitrary code execution within the renderer sandbox.

While Chrome’s sandboxing and Control Flow Integrity measures significantly raise the bar for code-execution exploits, a successful escape could compromise user data and system stability.

Google has not observed widespread exploitation in the wild but warns that proof-of-concept code could soon emerge.

Update and Mitigation Recommendations

All Chrome users are strongly urged to update to the latest stable build immediately.

The automatic update mechanism will deliver the patch over the next several days; users who wish to expedite the process can manually check for updates via Menu > Help > About Google Chrome.

Enterprises should push the update through centralized management consoles to ensure rapid deployment across all endpoints.

Google retains certain bug details under restricted access until a majority of users receive fixes, particularly for issues rooted in third-party libraries still under remediation elsewhere.

To report new issues, security researchers and users may file bugs at crbug.com or seek assistance in the community help forum.

For further information on Chrome security practices and past advisories, please visit the Chrome Security Page.

Google thanks all external researchers who collaborated during the development cycle to prevent vulnerabilities from reaching stable releases.

Continued use of sanitizers and fuzzers such as UndefinedBehaviorSanitizer and AFL remains central to hardening Chrome against emerging threats.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates