Google has confirmed a highly risky zero-day vulnerability inside Chrome. According to reports, this bug has forced the company into emergency mode, requiring a rapid security patch for over 2 billion users worldwide.
Reportedly, the flaw is embedded deep within Chrome’s underlying V8 JavaScript engine. The alarming part is that the organization has admitted that attackers had already been exploiting this bug at the time of discovery. Therefore, Google went for one of the most powerful browser updates to resolve these issues on an emergency basis.
Google publicly confirmed a zero-day flaw in Chrome’s V8 engine, which is the core JavaScript and WebAssembly engine. The flaw is a ‘type confusion’ bug, which allows malicious websites to execute arbitrary code, hijack browsing sessions, or crash devices.
For how long it was there is unknown, but the company has confirmed that the bug bypassed normal checks because it was dormant all the while. After attackers started actively targeting this vulnerability, the loophole came to light through crash logs and behavioural anomalies. Google never mentioned who the attackers were, but they might be state-sponsored cyber actors.
Regarding the victims, the zero-day is a threat to thousands of companies worldwide, as it lies at the heart of Google Chrome until patched. Most importantly, it affected all the desktop versions and experts warn that other Chromium-based browsers, like Edge, Brave, Opera, and Vivaldi, may also require urgent updates since they share the core components with Chrome.
Officially, Google has acknowledged the bug and Google’s security advisory confirms the seriousness of the threat stating, “We are aware that an exploit for CVE-2025-13223 exists in the wild.”
To patch the bug, Google has released patched versions for every device:
142.0.7444.175/.176 for Windows
142.0.7444.176 for macOS
142.0.7444.175 for Linux
The tech giant has stressed that the fix will become active only after users restart the browser after the update is completed. For most users, the update must be automatic; if not, they have to do it manually.
The zero-day incident has raised an important question: how can a single browser vulnerability put billions at immediate risk worldwide?
The reason is that Chrome holds a dominant share of the global browser market and powers countless apps, work systems, enterprise dashboards, and web-based tools. Therefore, a single flaw can threaten not just individuals but governments, global businesses, and critical infrastructure.
While Google has promised to run deeper review processes and faster zero-day mitigation cycles, it remains to be seen whether these measures can prevent similarly hidden vulnerabilities from resurfacing.