⚡ Weekly Recap: Chrome 0-Day, Data Wipers, Misused Tools and Zero-Click iPhone Attacks
Summary: Google released Chrome versions 137.0.7151.68/.69 for Windows and macOS and 137.0.7151.68 for Linux to fix a high-severity out-of-bounds read and write in the V8 JavaScript and WebAssembly engine that has been exploited in the wild. Google credited Clement Lecigne and Benoît Sevens of its Threat Analysis Group with reporting the flaw on May 27, 2025, and said it is not currently known how the flaw is being exploited, though it is likely highly targeted.
What's compelling: A Chrome zero-day found by Google's own threat researchers and already exploited in the wild means the browser on nearly every employee desktop was a live attack surface until this patch, and the exploitation method remains unknown.