Critical Chrome Update: Patch CVE-2025-9478 Before Attackers Strike

A critical security update has been released for the Chrome Stable channel to address a use-after-free vulnerability in the ANGLE graphics library. This flaw, identified as CVE-2025-9478, could allow attackers to execute arbitrary code on vulnerable systems.

The vulnerability resides in the ANGLE (Almost Native Graphics Layer Engine) component of Chrome, which translates OpenGL ES API calls into hardware-specific graphics API calls. A use-after-free vulnerability occurs when a program continues to use a memory pointer after it has been deallocated. In this case, a malicious website could exploit this condition by carefully crafting WebGL or Canvas operations to corrupt the browser’s memory, leading to remote code execution.

Google’s Big Sleep AI-powered vulnerability research team discovered the security flaw on August 11, 2025.

Successful exploitation of this vulnerability could allow attackers to install malware, steal data, or pivot deeper into a corporate network. The vulnerability is particularly concerning due to ANGLE’s widespread use in web applications that utilize WebGL rendering, HTML5 Canvas operations, and GPU-accelerated graphics processing. Attackers could leverage drive-by download attacks, malicious advertisements, or compromised websites to deliver exploit payloads.

• TA0002 – Execution: Adversaries may try to run malicious code on the victim endpoint or system. Execution consists of techniques that result in running adversary-controlled code locally or remotely.
• T1203 – Exploitation for Client Execution: Adversaries may exploit software vulnerabilities in client applications to execute malicious code.

To mitigate the risk, users are advised to update Chrome to version 139.0.7258.154/.155 or later immediately. Organizations should prioritize deploying the update and consider implementing additional security measures:

• Application allowlisting
• Network segmentation
• Endpoint detection and response (EDR) solutions
• Content Security Policy (CSP) headers
• Browser isolation technologies

Security teams should also monitor for unusual network traffic patterns, unexpected process spawning, and anomalous memory allocation behaviors.

Saner patch management is a continuous, automated, and integrated software that instantly fixes risks exploited in the wild. The software supports major operating systems like Windows, Linux, and macOS, as well as 550+ third-party applications.

It also allows you to set up a safe testing area to test patches before deploying them in a primary production environment. Saner patch management additionally supports a patch rollback feature in case of patch failure or a system malfunction.

Experience the fastest and most accurate patching software here.