Google fixes eighth Chrome zero-day exploited in attacks in 2025

Google issued emergency Chrome updates to patch a high‑severity zero‑day exploited in the wild—its eighth actively exploited Chrome vulnerability this year—rolling Stable Desktop builds to Windows (143.0.7499.109), macOS (143.0.7499.110) and Linux (143.0.7499.109). The flaw, attributed to a buffer‑overflow in the ANGLE/LibANGLE Metal renderer, can cause memory corruption, crashes, information leaks and arbitrary code execution; Google said it is withholding full technical details and the CVE while coordinating fixes and waiting for broad user and third‑party library updates. The patch follows seven other zero‑days addressed since January, including a V8 JavaScript engine bug (CVE‑2025‑5419), an account‑hijack vulnerability (CVE‑2025‑4664) and a sandbox escape used in espionage (CVE‑2025‑2783), highlighting the operational imperative for rapid enterprise patching to reduce immediate compromise risk.

Analysis

Google issued emergency Chrome updates to remediate a high-severity zero-day exploited in the wild, marking the eighth actively exploited Chrome vulnerability addressed this year. Stable Desktop builds were rolled out to Windows (143.0.7499.109), macOS (143.0.7499.110) and Linux (143.0.7499.109); Google warned rollout could take days or weeks although updates were immediately available when BleepingComputer checked. The company confirmed an exploit for 466192044 exists and is withholding full technical details and a CVE ID while coordinating fixes.

Chromium bug data attributes the flaw to a buffer-overflow in the open-source LibANGLE/ANGLE Metal renderer caused by improper buffer sizing, with impacts that can include memory corruption, crashes, sensitive information leakage and arbitrary code execution. Google noted it may retain disclosure restrictions if the bug resides in third-party libraries, implying remediation may require external vendors to patch. The vulnerability targets a graphics-translation layer rather than core V8, but still enables high-impact outcomes if weaponized.

This patch follows seven zero-days earlier in the year—including V8 and account-hijack bugs (CVE-2025-5419, CVE-2025-4664) and a sandbox escape used in espionage (CVE-2025-2783)—raising operational and reputational risk for Google and enterprise users. Market sentiment is mildly negative and the reported market-impact score is low (0.25), suggesting limited immediate share-price disruption but meaningful governance, customer-trust and potential regulatory exposure that investors should monitor closely.

Key Decisions for Investors

• Monitor Google's public disclosures, exploit breadth and patch adoption metrics closely and reassess exposure if Google releases further technical details or if exploit reports broaden
• Maintain a neutral-to-cautious stance on GOOGL/GOOG in the near term—no immediate sell signal given limited market-impact, but be prepared to trim positions if zero-day frequency or customer-impact disclosures accelerate
• For portfolios with concentration in web-dependent or enterprise software names, prioritize holdings with demonstrable patch-management and incident-response controls and review counterparty security practices
• Consider tactical hedges (options or reduced beta) to protect against reputational or regulatory shocks tied to continued browser vulnerabilities, and set clear triggers based on exploit reports and patch-adoption thresholds