Google Chrome < 132.0.6834.110 — RCE
Two High-severity V8 memory-safety bugs in Chrome — an object-corruption flaw (CVE-2025-0611) and an out-of-bounds memory access (CVE-2025-0612) — both reachable via a crafted HTML page. Update Chrome to 132.0.6834.110/.111.
Either bug lets attacker-controlled JavaScript on a crafted page corrupt V8 heap state and gain a write-what-where primitive inside the renderer. With a separate sandbox escape, this becomes drive-by code execution under the user account running Chrome. Without sandbox escape, the renderer-process foothold still exposes session cookies, saved-form data, and content of any same-origin tabs the renderer is allowed to see — high value on a jump host where the user is logged into management consoles.
Chrome 132.0.6834.110 patches two distinct V8 memory-safety bugs disclosed together. CVE-2025-0611 is an object-corruption / heap-based overflow: attacker-controlled JavaScript drives V8 into a state where it writes past the end of a heap object, corrupting adjacent metadata. CVE-2025-0612 is an out-of-bounds memory access — V8 reads or writes outside the bounds of an allocated buffer. Either yields the same primitive: controlled heap corruption inside the renderer process, the building block for renderer-process code execution.
Probably yes if any of these apply:
Affected OS versions
Google shipped 132.0.6834.110/.111 on January 22, 2025. CVE-2025-0612 was credited to Alan Goodman (reported December 20, 2024); CVE-2025-0611 was credited to an external researcher under Google's VRP. Neither was reported as exploited in the wild prior to patch. Microsoft Edge picked up the matching fix in 132.0.2957.127 the next day. The pattern — two V8 memory bugs in a single mid-cycle release — has been recurring in Chrome's 2024–2025 cadence, reflecting the increasing share of V8 fuzzing inside Google and the broader research community.
Manual remediation steps
⏱ 10 minutes (browser relaunch only)Check current Chrome version
(Get-ItemProperty 'HKLM:\SOFTWARE\Google\Chrome\BLBeacon' -ErrorAction SilentlyContinue).version
Update Chrome
$gu = "$env:ProgramFiles\Google\Update\GoogleUpdate.exe"
if (-not (Test-Path $gu)) { $gu = "${env:ProgramFiles(x86)}\Google\Update\GoogleUpdate.exe" }
if (Test-Path $gu) { & $gu /ua /installsource scheduler }
Verify
(Get-ItemProperty 'HKLM:\SOFTWARE\Google\Chrome\BLBeacon').version
# Must show 132.0.6834.110 or later.
No tested PowerShell script for this entry yet. We’re prioritising automation based on user demand.
References