Google has shipped a security update for Chrome that fixes a critical use-after-free vulnerability in the ServiceWorker component, tracked as CVE-2025-10200. The issue, reported by security researcher Looben Yang, earned a $43,000 bug bounty. A second flaw, CVE-2025-10201, affecting Mojo (Chrome’s IPC framework), was also addressed, with $30,000 awarded to Sahan Fernando and an anonymous researcher. Google has not reported active exploitation but urges users and organizations to update promptly.
CVE-2025-10200: ServiceWorker use-after-free and risk of code execution
Use-after-free vulnerabilities occur when software continues to use memory after it has been released, potentially allowing attackers to manipulate that memory and trigger arbitrary code execution. In the browser context, this can be achieved by directing a victim to a crafted webpage or malicious content. Because ServiceWorker brokers background tasks, caching, offline behavior, and intercepts network requests, a memory-safety error in this component can be particularly impactful in real-world browsing scenarios.
Why memory-safety bugs remain prevalent in Chrome
Memory-safety issues consistently rank among the most serious bugs in large C/C++ codebases. Chromium engineering reports have repeatedly noted that a significant share—historically around 70%—of high-severity Chrome vulnerabilities trace back to memory safety defects. Google mitigates these risks with defense-in-depth measures like process sandboxing and prompt patching, but attackers often chain multiple bugs to bypass protections. Quick update adoption remains essential to reduce exposure windows.
Additional fix: CVE-2025-10201 in Mojo IPC
The update also resolves CVE-2025-10201 in Mojo, Chrome’s interprocess communication framework that underpins many internal APIs. While rated lower in severity than the ServiceWorker bug, implementation flaws in Mojo can facilitate data integrity issues or amplify impact when combined with other vulnerabilities. Keeping IPC layers robust is vital to maintaining Chrome’s overall security model and process isolation guarantees.
Fixed versions and how to update Chrome securely
The patches are available in stable builds: 140.0.7339.127/.128 for Windows, 140.0.7339.132/.133 for macOS, and 140.0.7339.127 for Linux. To verify your version and update, navigate to: Menu → Help → About Google Chrome. Updates apply automatically, but a browser restart is required to complete installation.
At publication time, Google indicated no confirmed in-the-wild exploitation. Nonetheless, reducing the time between patch release and installation is one of the most effective ways to limit the success rate of browser-targeted attacks, especially those leveraging memory corruption.
Bug bounty incentives continue to raise the security bar
The $43,000 and $30,000 rewards underscore Google’s ongoing investment in vulnerability research. Just a month earlier, a researcher known as Micky received a $250,000 payout for a Chrome sandbox escape—an especially high-impact class of bug because the sandbox is designed to contain damage even after a renderer compromise. These incentives drive early discovery and coordinated disclosure, helping the broader ecosystem patch before attackers weaponize issues.
Practical guidance for enterprises and end users
Organizations should expedite deployment via managed updates, monitor fleet versions, enforce Chrome update policies, and tightly govern extensions (e.g., allowlists, permission reviews). Security teams can supplement controls with endpoint detection, Safe Browsing enforcement, and user-awareness campaigns focused on phishing and malicious advertising, common vectors for browser exploitation.
Individual users should update immediately to the latest stable build (140.0.7339.127+ on Windows/Linux and 140.0.7339.132+ on macOS), enable automatic updates, limit extensions to trusted publishers, and avoid high-risk sites. Keeping Chrome current is the simplest and fastest way to lower compromise risk from web-borne threats.
Chrome’s rapid patch cadence, sandboxing, and robust bug bounty program have substantially raised the cost of exploitation, but memory-safety issues remain a frequent target. Update to the newest versions today, restart your browser to finalize the fix, and follow the official Chrome Releases channel for timely security advisories. Shortening the “patch gap” is the most reliable defense against emerging exploit chains.
