Google does a great job of issuing security warnings, from the threats posed by malicious VPNs to the steps taken to protect Gmail accounts against ongoing hack attacks. While cybercriminals happily pay bottom dollar to steal passwords from Chrome users, Google pays much more, $11.8 million in 2024 alone, to help protect browser users from vulnerabilities before they can be used to attack them. Here’s the thing: all that work, all that money, only pays off for the end user if they ensure that their web browser is up to date. Which, despite automatic security updates, means you still need to do one thing: restart Chrome. So far, in 2025, there have been no fewer than seven zero-day vulnerabilities confirmed. So, ask yourself this: when was the last time I restarted my Chrome browser?
Google Has Confirmed Seven Zero-Day Chrome Vulnerabilities in 2025
Not all vulnerabilities are equal. There, I’ve said it. While all security vulnerabilities do, of course, need to be taken seriously, not every one will have an impact on every user, every organization, and as such, patch management always adopts a priority system which tackles the ones bringing the most danger to the enterprise first. When it comes to consumers, however, the choice is generally much easier: update already. All that said, in the unequal world of vulnerability remediation, one thing remains true: all zero-days are of the highest priority as they are, by definition, already being exploited by attackers out here in the real world. Which is why, when Google has confirmed seven of the things thus far in 2025, you’d better have taken them very seriously indeed. Let’s look at those seven, shall we?
Starting with the most recent and working our way back, these are:
- CVE-2025-13223. A type confusion vulnerability in the Chrome V8 JavaScript rendering engine that could enable an attacker to remotely execute arbitrary code. Google issued a security update to patch this zero-day on November 17.
- CVE-2025-10585. Guess what? Yep, this was also a V8 type confusion issue, resulting in the same potential consequences. Google issued a security update on September 17.
- CVE-2025-6558. By way of a change, this one was nothing to do with Chrome’s V8 engine, but just as worrying this zero-day impacted ANGLE, Google’s ‘Almost Native Graphics Layer Engine’ and the Chrome GPU. The end result? A sandbox escape if an attacker exploited it. Google issued a security update on July 15.
- CVE-2025-5419. It was nice while it lasted, but back to the V8 engine we go. This out-of-bounds zero-day could let attackers execute arbitrary code and escape the sandbox, using a maliciously crafted web page. Google issued a security update on June 3.
- CVE-2025-6554. Another V8 engine type-confusion vulnerability, which could lead to the arbitrary execution of code as well as browser crashes. Google issued a security update on June 30.
- CVE-2025-4664. An insufficient policy enforcement in the Chrome Loader function that, if exploited successfully, could lead to unauthorized code execution. Google issued a security update on May 14.
- And finally, or should that be firstly, comes CVE-2025-2783. This is an incorrect handle vulnerability within Mojo, Chrome’s inter-process communication, that, like so many of the zero-days, could lead to arbitrary file execution. Google issued a security update on March 25.
Why You Must Restart Google Chrome Regularly
“To make sure that you’re protected by the latest security updates,” Google has stated, “Google Chrome can automatically update when a new version of the browser is available on your device.” These automatic update checks happen in the background, without any input from you as the Chrome user. However, it is vital that you to do two things:
Firstly, Chrome security updates roll out over a number of days, so the critical patch concerned might not reach you immediately. This is not ideal, and as such, I always recommend heading straight for the Chrome ‘Help|About Google Chrome’ menu to kickstart the process.
Secondly, as Google has advised,“updates happen in the background when you close and reopen your computer’s browser,” and if you sense a but coming up, here it is, “but if you haven’t closed your browser in a while, you might see a pending update.” Which brings me nicely to the point: this is why you must restart your Google Chrome browser regularly, because any security update will not be activated and provide you with protection until you do.
