Google Chrome < 132.0.6834.83

Each of the five High-severity items is independently sufficient for renderer-process code execution or heap corruption when a user navigates to an attacker-controlled page. Chained with a sandbox escape (a separate bug class Chrome has had several of in 2024–2025) any of them becomes a zero-click drive-by RCE on the host. The Medium-severity fenced-frames and navigation bugs additionally enable spoofing UI and bypassing origin checks — useful for phishing pages that need to look exactly like an internal management console.

Chrome 132 bundles 16 individually-tracked security defects. The High-severity set is the memory-safety core: CVE-2025-0434 (out-of-bounds memory access in V8), CVE-2025-0435 (inappropriate implementation in Navigation, which can enable URL-spoofing or origin-confusion), CVE-2025-0436 (integer overflow in the Skia graphics engine reachable from rasterising a crafted page), CVE-2025-0437 (out-of-bounds read in Metrics — heap corruption / information leak from a crafted page), and CVE-2025-0438 (stack buffer overflow in Tracing). The Medium-severity remainder covers race conditions in Frames, fullscreen-prompt bypass, fenced-frames sandboxing gaps, payments-handler logic flaws and extension data-validation issues. Several reporters were paid VRP bounties; one of the V8 bugs originated from TyphoonPWN 2024.

Probably yes if any of these apply:

Google promoted Chrome 132 to the stable channel on January 14, 2025. The release post explicitly notes that "Google is aware that an exploit for CVE-2025-X exists in the wild" is NOT present for any of the fixes — none were exploited at patch time. Coverage by SecurityWeek, Lookout and the Hong Kong Computer Emergency Response Team coordination centre flagged it as a routine but unusually large monthly cumulative — most months land four to eight CVEs; 16 in one release is a meaningful step up. Enterprise change-management teams typically deferred this one until the following day to let the early-stable noise settle.