Google has released a major security update for Chrome , addressing two serious vulnerabilities that could put millions of users worldwide at immediate risk. The new version 143.0.7499.146/.147 is already available for Windows and macOS , while on Linux it is available as 143.0.7499.146 , with the gradual installation expected to be completed in the coming days.
This particular upgrade is not just another standard update, but a critical intervention that addresses bugs capable of allowing remote execution of malicious code.
Chrome: Two high-severity vulnerabilities in the spotlight
According to Google's official update, the new stable version of Chrome fixes two high-risk security vulnerabilities, which are particularly worrying due to their nature and the way they are exploited.
See also: React2Shell vulnerability used to install Linux Backdoors
Security researchers point out that such vulnerabilities can be exploited by attackers without physical access to the system, as long as the user visits a malicious website or interacts with specially crafted content.
CVE-2025-14765: Critical bug in WebGPU
The first vulnerability, codenamed CVE-2025-14765 , concerns a use-after-free error in WebGPU . The problem was discovered on September 30, 2025 by an anonymous researcher and is related to incorrect memory management . In practical terms, this means that an attacker can manipulate memory areas that have already been freed, leading to unpredictable behavior or even a complete system compromise .
The seriousness of the discovery is also reflected in the $10,000 prize offered by Google as part of its bug bounty program, underlining the high risk posed by this particular error.
CVE-2025-14766: Vulnerability in the V8 JavaScript engine
The second vulnerability, CVE-2025-14766, affects the V8 JavaScript engine, the heart of Chrome and many other applications. It is an out-of-bounds read and write, which allows access to memory areas outside the allowed boundaries.
See also: FreePBX fixes critical vulnerabilities that allow RCE attack
The vulnerability was discovered on December 8, 2025 by researcher Shaheen Fazim and is considered extremely dangerous, as it can lead to the theft of sensitive data or the execution of arbitrary code. Such errors in core subsystems, such as V8, are considered among the most serious in the browser space.
Which users are affected and what they should do
Windows and macOS users will receive the update automatically through Chrome's update mechanism, although Google warns that full rollout may take a few weeks.
On Linux, it is recommended to manually check via Settings > About Chrometo ensure the installation is immediate. Google makes it clear that this update should be treated as a priority, especially for business environments and organizations with multiple systems.
How Google secures Chrome
The company systematically invests in advanced error detection tools, such as AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer and Control Flow Integrity. At the same time, it uses fuzzing tools such as libFuzzer and AFL to identify extreme usage scenarios.
Particularly important is the collaboration with independent security researchers, who act as an external line of defense before problems reach stable releases.
See also: Vulnerability in Plesk allows root access
Why this update shouldn't be ignored
In an era where browsers are the primary gateway to the internet, any serious vulnerability translates into a potential risk to personal data, corporate networks, and critical infrastructure. Updating Chrome promptly is not just good practice, but a key cybersecurity measure.
The recommendation is clear: immediately check the version of Chrome you are using and make sure you have the latest update installed. In enterprise environments, rapid patch deployment can prevent serious security incidents before they occur.
