Update your Chrome to fix new actively exploited zero-day vulnerability

Google has released an update for its Chrome browser to patch an actively exploited flaw.

This update is crucial since it addresses an actively exploited vulnerability which can be exploited when the user visits a malicious website. It doesn’t require any further user interaction, which means the user doesn’t need to click on anything in order for their system to be compromised.

The update brings the Stable channel to 138.0.7204.96/.97 for Windows, 138.0.7204.92/.93 for Mac and 138.0.7204.96 for Linux.

The easiest way to update Chrome is to allow it to update automatically, but you can end up lagging behind if you never close your browser or if something goes wrong—such as an extension stopping you from updating the browser.

To manually get the update, click the more menu (three stacked dots), then choose Settings > About Chrome. If there is an update available, Chrome will notify you and start downloading it. Then all you have to do is reload Chrome in order for the update to complete, and for you to be safe from the vulnerability.

You can find more elaborate update instructions and the version number information in our article on how to update Chrome on every operating system.

Technical details on the vulnerability

The vulnerability, tracked as CVE-2025-6554 is a type confusion in V8 in Google Chrome that, prior to 138.0.7204.96, could have allowed a remote attacker to perform arbitrary read/write via a crafted HTML page.

A type confusion bug happens when code doesn’t verify the object type passed to it, and then uses the object without type-checking. Unfortunately, this bug occurs on the V8 JavaScript engine, Google’s open-source JavaScript engine.

The browser mistakenly treats a piece of data as the wrong type, which lets attackers manipulate memory in unintended ways. This can allow them to perform unauthorized read and write operations in the browser’s memory.

Clément Lecigne of Google’s Threat Analysis Group (TAG) has been credited with discovering and reporting the flaw on June 25, 2025. The TAG group focuses on spyware and nation-state attackers who abuse zero days for espionage purposes.

We don’t just report on browser vulnerabilities, Malwarebytes’ Browser Guard protects your browser against malicious websites and credit card skimmers, blocks unwanted ads, and warns you about relevant data breaches and scams.