Chrome Update Neutralizes High-Risk Audio Exploit Targeting Web Browsers
On May 6, 2025, Google rolled out an urgent Chrome update aimed at neutralizing a serious security threat within its WebAudio framework—a flaw that could let attackers hijack systems simply by getting users to visit a malicious website.
The update—Chrome version 136.0.7103.92 for Linux and 136.0.7103.92/.93 for Windows and macOS—includes a patch for CVE-2025-4372, a vulnerability rooted in improper memory handling. Specifically, it addresses a Use-After-Free (UAF) condition that allowed memory to be re-accessed after being released, exposing users to arbitrary code execution.
The flaw was uncovered by Huang Xilin from Ant Group’s Light-Year Security Lab, who reported the issue on April 20. Google rewarded the discovery with a $7,000 bounty under its vulnerability disclosure program.
Michael Wilson, a security researcher who helped coordinate the mitigation, explained:
“The problem stemmed from mismanaged memory in the MediaStreamAudioDestinationNode. Once released, this memory could be unpredictably accessed and manipulated, opening the door for code injection.”
Although Google’s internal rating labeled the bug as “Medium” severity, independent cybersecurity analysts, including those at Tenable, deemed it far more dangerous—assigning a near-maximum CVSS score of 9.8. The reason: the exploit demands no special user permissions and can be triggered with minimal interaction.
Security professionals are urging users and organizations to update Chrome immediately to prevent exploitation.
Security Risk Summary
| Category | Information |
|---|---|
| Impacted Versions | Chrome builds earlier than version 136.0.7103.92 |
| Threat Level | Allows remote attackers to run unauthorized code by corrupting memory |
| Trigger Conditions | Requires a user to open a compromised website containing specially crafted HTML |
| Severity Rating (CVSS v3.1) | Assessed as Medium risk based on exploitation complexity and impact |
Chrome Reinforces Audio Engine Security with Structural Overhaul and Broader Hardening
To plug a critical security hole in its audio engine, Google has reengineered the way Chrome handles active audio nodes. Specifically, it reclassified the MediaStreamAudioDestinationNode as an ActiveScriptWrappable, ensuring these nodes remain intact while still in use by executing scripts—thereby eliminating a key pathway to memory misuse and potential code execution.
This technical shift directly addresses the root of a dangerous memory corruption flaw and exemplifies how Google is hardening the foundations of its browser against low-level threats.
WebAudio isn’t new territory for attackers. Vulnerabilities such as CVE-2023-6345 and CVE-2024-0224 have previously targeted this intricate subsystem, underscoring the risks associated with real-time media processing in modern browsers.
Chrome’s defense strategy relies heavily on an arsenal of advanced diagnostic and fuzzing tools. Proprietary utilities like AddressSanitizer (ASan), MemorySanitizer, and UndefinedBehaviorSanitizer work in tandem with fuzzing engines like libFuzzer and AFL to catch subtle bugs before they can be exploited. ASan, in particular, has proven indispensable for exposing memory access violations such as use-after-free errors, despite the performance trade-offs it imposes during testing.
Beyond patching this specific vulnerability, the latest Chrome release includes a suite of additional security enhancements uncovered during internal reviews and stress testing.
While Google is deploying the fix progressively through automatic updates, cybersecurity professionals strongly advise users to act now: visit chrome://settings/help to confirm your browser is current and close the door on known threats.
