Vulnerability DatabaseCVE-2025-6192

CVE-2025-6192:
Google Chrome vulnerability analysis and mitigation

Overview

CVE-2025-6192 is a high-severity use-after-free vulnerability discovered in Google Chrome's Profiler component prior to version 137.0.7151.119. The vulnerability was reported by security researcher Chaoyuan Peng (@ret2happy) on May 31, 2025, and was subsequently patched in the stable channel update (Chrome Release).

Technical details

The vulnerability is classified as a use-after-free (CWE-416) issue affecting the Profiler component in Google Chrome. This type of vulnerability occurs when a program continues to use a memory location after it has been freed, potentially leading to memory corruption. The severity of this vulnerability has been rated as High with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) (NVD).

Impact

The vulnerability allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, which could lead to arbitrary code execution within the browser's context. This could potentially allow attackers to execute malicious code, access sensitive information, or cause system crashes (Security Online).

Mitigation and workarounds

Google has released a patch in Chrome version 137.0.7151.119/.120 for Windows and macOS, and version 137.0.7151.119 for Linux. Users are strongly advised to update their Chrome browsers to these versions or later to mitigate the vulnerability. The update can be triggered manually by navigating to Settings > About Chrome (Chrome Release).

Community reactions

The vulnerability was deemed significant enough to warrant a $4,000 bug bounty reward from Google's Vulnerability Rewards Program, indicating its severity and potential impact (Security Online).