# Chrome 146 Patch: Two Exploited Zero-Days CVE-2025-0672 and CVE-2025-0673

> Google addresses two actively exploited vulnerabilities in Chrome 146. CVE-2025-0672 and CVE-2025-0673 allow data manipulation and remote code execution.

- Published: 2026-03-13T08:18:16.000Z
- Severity: critical
- Category: Vulnerabilities
- Tags: Chrome, Google, CVE-2025-0672, CVE-2025-0673, Zero-Day, Dawn
- Author: Runtime Rebel Intel
- Primary source: https://www.securityweek.com/chrome-146-update-patches-two-exploited-zero-days/
- Canonical: https://runtimerebel.com/blog/chrome-146-patch-two-exploited-zero-days-cve-2025-0672-and-cve-2025-0673

## Key points

- Immediate impact: Attackers are actively exploiting two vulnerabilities in Google Chrome to bypass security and execute code on target systems.
- Affected systems: The vulnerabilities impact all desktop versions of Google Chrome including Windows, macOS, and Linux prior to the Chrome 146 update.
- Remediation: Administrators must immediately update all browser installations to the latest version to mitigate these active zero-day threats.

Google has issued an urgent security update for the Chrome browser to address two high-severity vulnerabilities that are being actively exploited in the wild. These [Zero-Day](/glossary#zero-day) flaws, identified as [CVE-2025-0672](https://nvd.nist.gov/vuln/detail/CVE-2025-0672) and [CVE-2025-0673](https://nvd.nist.gov/vuln/detail/CVE-2025-0673), represent a significant risk to the integrity of enterprise endpoints. According to [SecurityWeek](https://www.securityweek.com/chrome-146-update-patches-two-exploited-zero-days/), these flaws allow threat actors to manipulate data and bypass critical security restrictions, which can eventually lead to [RCE](/glossary#rce).

## Technical Analysis of Exploited Flaws

The vulnerabilities identified in this release represent two distinct attack vectors within the browser's architecture. Both were reported by researchers within Google's Threat Analysis Group (TAG), a team known for tracking sophisticated [APT](/glossary#apt) activity and state-sponsored cyber operations.

### CVE-2025-0673 use after free Dawn vulnerability details

The first flaw, [CVE-2025-0673](https://nvd.nist.gov/vuln/detail/CVE-2025-0673), is a Use After Free (UAF) condition residing in Dawn. Dawn is the cross-platform, open-source implementation of the WebGPU standard used within the Chrome engine. A UAF vulnerability occurs when a program continues to use a pointer after the memory it points to has been freed, which can be manipulated by an attacker to execute arbitrary code or cause a system crash. In the context of a browser, this often allows an attacker to escape the renderer sandbox, a critical step in achieving [Privilege Escalation](/glossary#privilege-escalation) on the host operating system. The [CVSS](/glossary#cvss) score reflects the high severity of memory corruption issues in core browser components.

### CVE-2025-0672: Inappropriate Implementation in Extensions

The second vulnerability, [CVE-2025-0672](https://nvd.nist.gov/vuln/detail/CVE-2025-0672), involves an inappropriate implementation within the Chrome Extensions framework. While specific [TTP](/glossary#ttp) details are often withheld by vendors until a majority of the user base has updated, this type of flaw typically concerns how the browser manages permissions or validates communication between extensions and the browser core. Organizations investigating how to detect CVE-2025-0672 exploit attempts should monitor for unusual browser extension behavior or unauthorized attempts to access sensitive browser data stores.

## Threat Context and Impact

The discovery of these flaws by Google TAG suggests that the exploitation may be part of a highly targeted campaign. When zero-days are utilized in the wild, they are frequently used as the initial access vector in a larger attack chain. Once the browser is compromised, attackers may attempt [Lateral Movement](/glossary#lateral-movement) within the internal network or deploy a [C2](/glossary#c2) beacon to establish long-term persistence. 

For a [SOC](/glossary#soc), the primary concern is the speed at which these vulnerabilities can be weaponized. While initial reports indicate targeted usage, once the details of the Chrome 146 zero-day mitigation are analyzed by other threat actors, the risk of broader exploitation increases. 

## Actionable Recommendations

Security teams should prioritize the following steps to ensure protection against these active threats:

*   **Emergency Patching:** Deploy the Chrome 146 update across all Windows, macOS, and Linux workstations immediately. 
*   **Enforce Restarts:** Since browser updates require a process restart to take effect, use management tools to force a restart for users who have not updated within 24 hours.
*   **Monitoring:** Update [EDR](/glossary#edr) and [SIEM](/glossary#siem) signatures to look for anomalous child processes spawned by browser executables, which is a common [IoC](/glossary#ioc) for successful browser exploitation.
*   **Review Extensions:** Audit the organization's allowed extension list to ensure that only verified and necessary extensions are installed, reducing the surface area for [CVE](/glossary#cve) exploitation.

By ensuring the rapid adoption of the Chrome 146 update, organizations can effectively close the window of opportunity for attackers seeking to leverage these critical memory and extension-based flaws.

**Related:** [CVE-2024-4947 and CVE-2024-4948: Google Patches Chrome Zero-Days](/blog/cve-2024-4947-and-cve-2024-4948-google-patches-chrome-zero-days), [Cisco SD-WAN Zero-Day CVE-2026-20127 Exploited for Admin Access](/blog/cisco-sd-wan-zero-day-cve-2026-20127-exploited-for-admin-access)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/chrome-146-patch-two-exploited-zero-days-cve-2025-0672-and-cve-2025-0673