Google has officially promoted Chrome 140 to the stable channel, initiating a multi-platform rollout for Windows, Mac, Linux, Android, and iOS.

The update brings the usual stability and performance improvements, but the headline feature is a critical security patch addressing six vulnerabilities, including one high-severity flaw that could allow for remote code execution.

Users are strongly advised to update their browsers immediately to protect against potential exploitation.

The new desktop version is identified as built 140.0.7339.80 for Linux and 140.0.7339.80/81 for Windows and Mac. The update is also being pushed to the Extended Stable channel with build 140.0.7339.81.

Key Takeaways
1. Chrome 140 is now stable on desktop and mobile, including extended-stable build 140.0.7339.81.
2. Six security bugs fixed.
3. GPU rasterization, faster HTTP/3, and CSS Container Queries support.

Mobile users will see updates with the version 140.0.7339.35 on Android and 140.0.7339.95 on iOS. While Google notes the rollout will occur over the coming days and weeks, manually checking for the update is recommended due to the severity of the patched flaws.

The most critical issue resolved in this update is a high-severity vulnerability tracked as CVE-2025-9864. This flaw is described as a “Use after free in V8,” the powerful open-source JavaScript and WebAssembly engine that powers Chrome.

A use-after-free vulnerability occurs when a program continues to use a pointer after the memory it points to has been deallocated.

By manipulating this memory state, a successful attacker could craft a malicious webpage that triggers the bug, potentially leading to a browser crash or, in a worst-case scenario, the execution of arbitrary code on the victim’s system. This vulnerability was reported by Pavel Kuzmin of the Yandex Security Team on July 28, 2025.

In addition to the V8 flaw, Google patched several medium-severity bugs reported by external researchers, including:

• CVE-2025-9865: An inappropriate implementation in the Toolbar.
• CVE-2025-9866: An inappropriate implementation in Extensions.
• CVE-2025-9867: An inappropriate implementation in Downloads.

Google awarded a total of $10,000 in bounties to the external researchers who discovered and reported these vulnerabilities, as stated in the advisory.

Update Rollout Details

Beyond the fixes contributed by external researchers, this release includes various other security enhancements resulting from Google’s own internal security work.

The company credits its robust internal auditing processes and sophisticated testing tools for catching many bugs before they ever reach the stable channel.

Google’s security teams extensively use automated tools like AddressSanitizer, MemorySanitizer, and UndefinedBehaviorSanitizer, as well as fuzzing technologies like libFuzzer and AFL, to proactively discover and neutralize memory corruption and other security flaws.

As the update for Chrome 140 rolls out globally, Google is restricting access to the specific bug details and links. This standard procedure is designed to prevent threat actors from reverse-engineering the exploits before a majority of users have installed the protective patch.

Users can ensure they are protected by navigating to Chrome’s “About Google Chrome” settings page, which will trigger the automatic download and installation of the latest version.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Chrome 140 Released With Fix For Six Vulnerabilities that Enable Remote Code Execution Attacks appeared first on Cyber Security News.

In response to the discovery of actively exploited 0-day vulnerabilities, Google has released its September 2025 Android Security Bulletin, rolling out patch level 2025-09-05 to safeguard millions of devices.

The bulletin details critical issues in both System and Kernel components, and emphasizes the importance of immediate updates to mitigate remote code execution risks.

Key Takeaways
1. Patch 2025-09-05 fixes CVE-2025-38352 (zero-interaction RCE) and CVE-2025-48543 (kernel EoP).
2. System bug needs no user action; kernel bug grants root.
3. Update now; AOSP source in 48 hrs.

Critical System Component RCE Vulnerability 

The flagship fix addresses CVE-2025-38352, a zero-interaction flaw in the Android System component that allows remote (proximal/adjacent) code execution without any elevated privileges. 

Google’s severity assessment rates this as Critical, noting that successful exploitation could grant attackers complete control of affected devices even with platform and service mitigations enabled in development environments. 

No user engagement, such as clicking a link or opening a file, is required to trigger the exploit.

Source code patches for CVE-2025-38352 are now available in the Android Open Source Project (AOSP) repository.

Google plans to update the bulletin with direct AOSP links within 48 hours of publication.

High-Severity Elevation of Privilege Flaw

Another patch targets CVE-2025-48543, an Elevation of Privilege (EoP) vulnerability in the Android Kernel. 

Rated High, this flaw could allow local code to gain root-level permissions, bypassing SELinux policies and other kernel-level safeguards. 

Affected versions include Android 13, 14, 15, and 16. Partners have received notification of both issues over a month in advance, ensuring OEMs can integrate the necessary kernel patches into upcoming device updates.

Users are strongly advised to verify their patch level is at least 2025-09-05 and to apply updates immediately.

Android partners have been briefed, and AOSP source code updates will be released shortly.

This coordinated effort underscores Google’s commitment to proactive vulnerability management and rapid response to emerging threats. 

Users and device manufacturers alike must prioritize this update to maintain the integrity of Android’s security posture.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post Android Security Update – Patch for 0-Day Vulnerabilities Actively Exploited in Attack appeared first on Cyber Security News.

CISA has issued an urgent advisory concerning a newly disclosed zero-day vulnerability in Meta Platforms’ WhatsApp messaging service (CVE-2025-55177). 

This flaw, categorized under CWE-863: Incorrect Authorization, allows an unauthorized actor to manipulate linked device synchronization messages and force a target device to fetch and process content from an attacker-controlled URL. 

Key Takeaways
1. CVE-2025-55177 exploits a WhatsApp device-sync auth flaw to fetch malicious URLs.
2. CWE-863 error enables RCE and has surfaced in phishing.
3. CISA mandates the Sept 2 patch or suspending WhatsApp.

Organizations and individual users are strongly urged to apply vendor-supplied mitigations by September 23, 2025, or to discontinue use until secure patches are available.

WhatsApp Authorization Vulnerability (CVE-2025-55177)

CVE-2025-55177 arises from an incomplete authorization check in WhatsApp’s handling of linked device synchronization messages. 

When a user links their WhatsApp client on a new device, synchronization messages propagate chat histories and media over multiple endpoints. 

Due to the improper verification of message source and integrity, an unrelated user can craft a malicious synchronization payload referencing an arbitrary URL. The vulnerable client will:

• Parse the synchronization message without verifying the sender’s authorization token.
• Initiate a GET request to the attacker-controlled URL to retrieve additional payload data.
• Execute or display content such as a JavaScript-powered web page in the context of the WhatsApp client.

This chain of events effectively enables remote code execution (RCE) or content spoofing, which could be leveraged to drop payloads ranging from credential-stealing scripts to ransomware. 

While it remains unconfirmed whether CVE-2025-55177 has been integrated into active ransomware campaigns, its exploitation in targeted phishing operations has already been observed.

Mitigations

CISA’s advisory instructs all entities using WhatsApp, particularly those in critical infrastructure sectors, to implement the following steps immediately:

Apply the patch released on September 2, 2025, by Meta Platforms as outlined in their Security Advisory.

Enforce the vendor’s configuration guidance, ensuring that linked-device synchronization messages are permitted only from authenticated endpoints.

Follow the Cybersecurity and Infrastructure Security Agency’s Binding Operational Directive (BOD) 22-01 requirements for cloud service security, including multi-factor authentication and robust logging of all synchronization events.

CISA advises discontinuing WhatsApp usage until a secure version is deployed. Organizations must also monitor network traffic for unusual outbound HTTP requests originating from WhatsApp clients, which may indicate exploitation attempts.

As a precaution, security teams should validate patch installation and verify that the fixed version correctly rejects unauthorized synchronization payloads.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post CISA Warns of WhatsApp 0-Day Vulnerability Exploited in Attacks appeared first on Cyber Security News.

A proof-of-concept exploit for CVE-2025-53772, a critical remote code execution vulnerability in Microsoft’s IIS Web Deploy (msdeploy) tool, was published this week, raising urgent alarms across the .NET and DevOps communities. 

The flaw resides in the unsafe deserialization of HTTP header contents in both the msdeployagentservice and msdeploy.axd endpoints, enabling authenticated attackers to execute arbitrary code on target servers.

Key Takeaways
1. IIS Web Deploy deserialization RCE (CVSS 8.8)
2. PoC uses MSDeploy.SyncOptions header to spawn commands
3. Mitigate by disabling agent, tightening access, and patching

Proof-of-Concept for IIS WebDeploy RCE Flaw

At the heart of CVE-2025-53772 is a custom deserialization routine that neglects robust input validation. 

Hawktrace reports that the vulnerable code path processes a Base64-encoded, GZip-compressed payload taken from the MSDeploy.SyncOptions HTTP header.

The sequence Base64 decoding followed by GZip decompression and BinaryFormatter.Deserialize() fails to enforce type whitelisting, allowing malicious payloads to instantiate dangerous objects. 

In particular, crafting a SortedSet<string> object backed by a manipulated MulticastDelegate invocation list triggers Process the start, leading to remote code execution.

The publicly available PoC demonstrates how an attacker can abuse .NET’s serialization mechanics:

Sending this payload in an HTTP POST to /msdeploy.axd results in calc.exe launching on the server.

Mitigation 

Microsoft has assigned a CVSS score of 8.8 for CVE-2025-53772. Immediate mitigation steps include disabling the Web Deploy Agent Service (MsDepSvc), enforcing strict network ACLs on the msdeploy.axd endpoint, and applying inbound filtering to block unexpected MSDeploy.SyncOptions headers. 

Long-term remediation requires replacing BinaryFormatter with a secure serializer (e.g., DataContractSerializer with explicit type contracts) and validating all header inputs before deserialization.

As PoC exploits circulate, organizations that leverage IIS Web Deploy must prioritize patching and hardening to prevent authenticated attackers from exploiting this critical RCE vector.

Find this Story Interesting! Follow us on Google News, LinkedIn, and X to Get More Instant Updates.

The post PoC Exploit Released for IIS WebDeploy Remote Code Execution Vulnerability appeared first on Cyber Security News.