Google fixes high-risk Chrome vulnerabilities with June update

Google has released a security update for its Chrome browser. Two vulnerabilities have been fixed in the new Chrome versions 137.0.7151.103/104 for Windows and macOS and 137.0.7151.103 for Linux. According to Google, none of the vulnerabilities are being exploited for attacks in the wild. The manufacturers of other Chromium-based browsers will follow suit in the coming days.

In the Chrome Releases blog post, Prudhvikumar Bommana lists the two vulnerabilities that were discovered by external security researchers and reported to Google. Google classifies both vulnerabilities as high risk. CVE-2025-5958 is a use-after-free vulnerability in the Media component. If successful, an attacker could inject and execute arbitrary code.

The second vulnerability, CVE-2025-5959, was demonstrated at the TyphoonPWN hacker competition at the end of May, which has been taking place since 2018 as part of the TyphoonCon security conference in Seoul. The vulnerability is once again a type mix-up in the V8 JavaScript engine, which can also be used to execute injected code.

Google has also released Chrome for Android 137.0.7151.89, which fixes the same vulnerabilities in the Android version of the browser as in the desktop versions.

Chrome usually updates itself automatically when a new version is available. But if you aren’t up to the latest version yet, you can manually initiate an update check using the three-dot menu and navigating to Help > About Google Chrome. Google plans to release Chrome version 138 at the end of June.

Other Chromium-based browsers

The manufacturers of other Chromium-based browsers should be following suit with their own updates soon.

Brave and Microsoft Edge have already switched to Chromium 137 and are currently at the security level prior to this Chrome update. Vivaldi once again relies on the Extended Stable Channel of the previous version and is therefore at the same security level as Brave and Edge.

But Opera’s browser still uses the outdated Chromium 134, for which Google no longer provides security updates.