Google fixes several security vulnerabilities with Chrome 140 update

Google has released the latest Chrome 140 update with several vulnerability fixes, available in Chrome versions 140.0.7339.80/81 for Windows and macOS and 140.0.7339.80 for Linux. According to Google, none of the vulnerabilities have been exploited in the wild. Other Chromium-based browsers will follow suit soon.

In the Chrome Releases blog post, Srinivas Sista lists the four of six fixed vulnerabilities that were discovered by external security researchers and reported to Google. Google categorizes one of them as high risk. The use-after-free vulnerability CVE-2025-9864 is located in the V8 JavaScript engine. The other vulnerabilities (CVE-2025-9865, CVE-2025-9866, and CVE-2025-9867) are only considered medium risk. Google hasn’t commented on internally discovered vulnerabilities.

Chrome usually updates itself automatically when a new version is available. You can manually trigger the update check using the menu item Help > About Google Chrome. Google has also released Chrome for Android 140.0.7339.35 and Chrome for iOS 140.0.7339.95. The same vulnerabilities have been fixed in the Android version as in the desktop versions. The Extended Stable Channel for Windows and macOS now also has version 140.0.7339.81 available.

Chrome 140 doesn’t offer any new features for users. Google plans to release Chrome 141 at the beginning of October.

Other Chromium-based browsers

The manufacturers of other Chromium-based browsers are now required to follow suit with updates. Microsoft Edge, Vivaldi, and Brave are currently at last week’s security status (prior to this patch).

Opera’s browser version 121 is stuck with outdated Chromium version 137, for which Google has not provided any updates since June 24th. The most recent update to version 121.0.5600.50 does not bring a more up-to-date Chromium version either.