Google has rolled out an emergency update for its Chrome browser, version 142, to address a series of serious remote code execution (RCE) vulnerabilities that could allow attackers to take control of affected systems. The update, released on November 5, 2025, is being distributed gradually across desktop platforms, Windows, macOS, and Linux, as well as Android devices through Google Play and Chrome’s built-in update mechanism.
The latest update fixes five distinct security flaws, three of which have been rated as high severity due to their potential for memory corruption and remote code execution. Among these, the most critical issue is CVE-2025-12725, a flaw found in WebGPU, Chrome’s graphics processing interface.
This vulnerability, caused by an out-of-bounds write error, could allow malicious code to overwrite crucial system memory and execute arbitrary commands. An anonymous security researcher first discovered CVE-2025-12725 on September 9, 2025. Google has restricted technical details of the exploit to prevent attackers from leveraging it before most users have applied the update.
Other High-Severity Issues: CVE-2025-12726 and CVE-2025-12727
Two other high-severity vulnerabilities were also patched. CVE-2025-12726, reported by researcher Alesandro Ortiz on September 25, involves an inappropriate implementation in Chrome’s Views component, the part responsible for handling the browser’s user interface. Meanwhile, CVE-2025-12727, identified by researcher 303f06e3 on October 23, affects Chrome’s V8 JavaScript engine, the core of Chrome’s performance and execution environment.
Both CVE-2025-12726 and CVE-2025-12727 could allow attackers to manipulate memory and potentially execute malicious code remotely. According to Google’s internal assessments, these vulnerabilities received CVSS 3.1 scores of 8.8, indicating direct risk.
Medium-Severity Omnibox Issues
Alongside these critical patches, Google addressed two medium-severity vulnerabilities in Chrome’s Omnibox, the combined search and address bar. CVE-2025-12728, reported by Hafiizh, and CVE-2025-12729, discovered by Khalil Zhani, both stem from inappropriate implementations that could lead to data exposure or UI manipulation. While not as severe as the WebGPU or V8 flaws, these issues still warrant prompt user updates to prevent potential misuse.
According to Google’s official release notes:
- Desktop (Windows, macOS, Linux): Version 142.0.7444.134/.135
- Android: Version 142.0.7444.138
Google emphasized that the Android release contains the same security fixes as its desktop counterparts. The rollout will continue over the next few days and weeks as part of the company’s staged deployment process.
Official Statement and Update Details
In the official blog post, Chrome team member Krishna Govind confirmed the emergency patch for Android and desktop. The post highlighted ongoing efforts to enhance stability and performance, while ensuring that users receive timely security updates.
“We’ve just released Chrome 142 (142.0.7444.138) for Android,” the statement read. “It’ll become available on Google Play over the next few days. If you find a new issue, please let us know by filing a bug.”
The blog also reiterated that Chrome’s Stable Channel Update for Windows, macOS, and Linux began rolling out simultaneously on November 5, 2025.
Google credited the security researchers who responsibly disclosed these vulnerabilities before they could be exploited. The company stated that detailed technical information will remain withheld until “a majority of users have updated,” reducing the risk of targeted attacks exploiting CVE-2025-12725, CVE-2025-12726, or CVE-2025-12727.
User Recommendations
It is recommended that all users update Chrome immediately. Desktop users should go to Settings → About Chrome to check for version 142.0.7444.134 or later, while Android users can verify updates via the Google Play Store. Enabling automatic updates is strongly advised to ensure future patches are applied as soon as they are released.
Even though the two Omnibox vulnerabilities (CVE-2025-12728 and CVE-2025-12729) are less critical, delaying updates can still expose users to phishing or injection risks through manipulated browser interfaces.
