Google has rolled out a crucial security update for Chrome 135 across all desktop platforms, addressing fourteen vulnerabilities, including high-severity flaws that could enable remote code execution. The stable channel update (135.0.7049.52 for Linux and 135.0.7049.41/42 for Windows/macOS) delivers urgent patches for numerous memory corruption and implementation issues actively exploited in the wild. This release underscores Google’s commitment to ensuring user safety despite persistent and evolving security challenges.
1. Addressing High-Severity Vulnerability
The most critical vulnerability, identified as CVE-2025-3066, involves a use-after-free flaw in navigation processes. This flaw allows attackers to execute arbitrary code via specially crafted web pages. Reported by Sven Dysthe through Chrome’s Vulnerability Reward Program, this memory corruption issue has been rated as “High” severity. Such vulnerabilities can severely compromise user security and privacy, making it imperative for users to update their browsers immediately.
2. Mid-Level Security Flaws
The update also fixes five medium-severity vulnerabilities that span across various critical components:
- Custom Tabs Vulnerability (CVE-2025-3067): This flaw allows privilege escalation and has a bounty of $10,000.
- Intents Handler Bypass (CVE-2025-3068): This vulnerability enables unauthorized actions and carries a $2,000 bounty.
- Extension System Flaws (CVE-2025-3069/3070): These flaws permit malicious payload injection and expose long-standing architectural issues in Chrome’s permission model, with some reports dating back several years.
These medium-severity flaws highlight potential risks in several key Chrome components, necessitating prompt updates to protect against possible exploitation.
3. Low-Risk Security Issues
In addition to the high and medium-severity issues, Google’s update addresses four lower-risk vulnerabilities:
- Navigation Handling (CVE-2025-3071): This fix resolves issues within Chrome’s navigation processes.
- Custom Tabs Validation (CVE-2025-3072): This correction ensures proper validation procedures within Custom Tabs.
- Autofill Protections (CVE-2025-3073): This update strengthens autofill feature defenses against misuse.
- Download Protections (CVE-2025-3074): This improvement enhances security during the download process.
Several external researchers who identified these vulnerabilities received $17,000 in bounties. Notably, TU Wien researcher Philipp Beer received the highest individual payout for his contributions.
4. Recommended Updating Actions
To safeguard against these vulnerabilities, Chrome users are advised to:
- Navigate to
chrome://settings/helpwithin their browser. - Allow automatic installation of updates.
- Restart the browser to apply the changes effectively.
Enterprise administrators can enforce updates through group policies, ensuring version 135.0.7049.52 or higher is implemented. Google has restricted detailed technical disclosures until the majority of users have updated, adhering to standard coordinated vulnerability disclosure practices.
This update serves as a reminder of Chrome’s ongoing security struggles despite significant investments in security measures like sandboxing and process isolation. The presence of vulnerabilities reported years ago indicates that some architectural limitations persist within the browser’s aged codebase, emphasizing the continuous need for vigilance and timely updates.
Conclusion and Future Considerations
Google has rolled out a critical security update for Chrome version 135, affecting all desktop platforms. This update addresses fourteen security vulnerabilities, including several high-severity flaws that posed risks of remote code execution. The update, version 135.0.7049.52 for Linux and 135.0.7049.41/42 for Windows and macOS, includes urgent patches to resolve memory corruption issues and fix implementation problems. Many of these vulnerabilities were actively exploited in the wild, making this update particularly important for users’ safety. By releasing this crucial update, Google emphasizes its ongoing commitment to user security, acknowledging the ever-present and evolving nature of online threats. Users are advised to update their Chrome browser promptly to benefit from these essential security enhancements and ensure their systems remain protected. This action underscores Google’s proactive approach in maintaining the security of its applications and protecting its users from potential cyber threats.