Security update for chromium
Description
This security update for Chromium addresses multiple vulnerabilities including a heap buffer overflow and several memory and data validation issues in DevTools. The update corresponds to Chromium versions 135.0.7049.114 and 136.0.7103.48, with the latter fixing four specific CVEs reported in early 2025. The update also includes stability fixes and upgrades to related components such as esbuild and Go. No CVSS score is provided, but the severity is assessed as high based on the nature of the vulnerabilities.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Chromium security update fixes four vulnerabilities: CVE-2025-4096 (heap buffer overflow in HTML), CVE-2025-4050 (out of bounds memory access in DevTools), CVE-2025-4051 (insufficient data validation in DevTools), and CVE-2025-4052 (inappropriate implementation in DevTools). These issues were reported by various researchers in early 2025. The update also includes component upgrades to esbuild (from 0.24.0 to 0.25.1) and Go (from 1.23.5 to 1.23.7), addressing source map path issues and regressions. The stable releases affected are Chromium 135.0.7049.114 and 136.0.7103.48.
Potential Impact
The vulnerabilities include a heap buffer overflow and out-of-bounds memory access, which could potentially lead to memory corruption or crashes. Insufficient data validation and inappropriate implementation in DevTools may allow for unexpected behavior or security bypasses. The overall impact is high due to the potential for memory corruption and exploitation of DevTools components.
Mitigation Recommendations
A security update is available that fixes these vulnerabilities in Chromium versions 135.0.7049.114 and 136.0.7103.48. Users and administrators should apply these updates promptly to mitigate the risks. No additional mitigation steps are indicated beyond applying the official update.
Technical Details
- Gcve Source
- db.gcve.eu
- Csaf Category
- csaf_security_advisory
- Csaf Version
- 2.0
- Publisher
- SUSE Product Security Team
- Advisory Id
- openSUSE-SU-2025:0145-1
- Cve Count
- 4
- Additional Cves
- ["CVE-2025-4051","CVE-2025-4052","CVE-2025-4096"]
Threat ID: 6ac2457612601ec6a3163ba7
Added to database: 10/04/2026, 12:24:22 UTC
Last enriched: 10/04/2026, 12:26:38 UTC
Last updated: 10/04/2026, 16:08:34 UTC
Views: 1
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.