Overview

• Google rolled out Chrome 138.0.7204.x on July 2 and 3 to fully patch the CVE-2025-6554 flaw in the V8 JavaScript engine that was being exploited in the wild.
• The Threat Analysis Group first detected the zero-day on June 25 and classified it as high risk before initial configuration mitigations were applied.
• Users are urged to check their browser version and install the update immediately to block ongoing exploits.
• Microsoft Edge, Brave, Opera and other Chromium-based browsers are expected to release corresponding security updates shortly.
• This marks the fourth actively exploited zero-day vulnerability Google has fixed in Chrome in 2025, highlighting persistent risks to browser security.