CVE-2025-3620: Google Chrome Use After Free Vulnerability

CVE-2025-3620 Overview

CVE-2025-3620 is a use-after-free vulnerability in the USB component of Google Chrome versions prior to 135.0.7049.95. A remote attacker can exploit heap corruption by serving a crafted HTML page to a victim. Chromium rates this issue as High severity, and successful exploitation can lead to arbitrary code execution within the renderer process. The vulnerability is tracked under CWE-416 and requires user interaction, such as visiting a malicious website. Google addressed the flaw in the Stable channel update for Desktop released in April 2025.

Critical Impact
Remote attackers can trigger heap corruption through a crafted HTML page, potentially leading to code execution in the browser context.

Affected Products

Google Chrome on Windows prior to 135.0.7049.95
Google Chrome on macOS prior to 135.0.7049.95
Google Chrome on Linux prior to 135.0.7049.95

Discovery Timeline

2025-04-16 - CVE-2025-3620 published to NVD
2025-04-23 - Last updated in NVD database

References: Google Chrome Update Blog, Chromium Issue Tracker Entry.

Technical Details for CVE-2025-3620

Vulnerability Analysis

The flaw resides in Chrome's USB subsystem, which exposes WebUSB functionality to web content. A use-after-free condition occurs when the implementation retains a reference to a heap object after that object has been deallocated. When the freed memory is reallocated for attacker-controlled data, subsequent dereferences operate on corrupted state. This primitive enables heap corruption that an attacker can shape into a control-flow hijack inside the renderer process. Chrome's sandbox limits direct system impact, but renderer compromise is typically chained with a sandbox escape for full code execution on the host.

Root Cause

The root cause is improper object lifetime management within the USB component [CWE-416]. Code paths handling USB device state release or destroy an object while another reference remains live. Web content can drive these paths through WebUSB-related JavaScript APIs and timing of device events, leading to access of freed memory.

Attack Vector

Exploitation requires a victim to load a crafted HTML page in a vulnerable Chrome build. The attacker hosts JavaScript that manipulates USB-related objects to trigger the dangling reference, then sprays the heap to reclaim the freed allocation with controlled data. Subsequent operations on the stale pointer pivot execution into attacker-controlled memory.

No verified public proof-of-concept is available. See the Chromium Issue Tracker Entry for any disclosed technical details once restrictions are lifted.

Detection Methods for CVE-2025-3620

Indicators of Compromise

Chrome renderer process crashes with heap corruption signatures shortly after visiting an untrusted page.
Unexpected child processes spawned by chrome.exe or the Chrome helper processes on macOS and Linux.
Outbound connections from Chrome to low-reputation domains immediately preceding renderer instability.

Detection Strategies

Inventory installed Chrome versions across endpoints and flag any build earlier than 135.0.7049.95.
Hunt for browser exploitation patterns such as renderer processes performing file system writes to autostart locations or launching shells.
Correlate web proxy logs with endpoint telemetry to identify users who visited suspicious pages around crash events.

Monitoring Recommendations

Forward Chrome crash reports and Windows Error Reporting events to a central log store for review.
Monitor process lineage where Chrome renderer or GPU processes spawn cmd.exe, powershell.exe, bash, or other interpreters.
Track WebUSB API usage on managed fleets through enterprise policy reporting where applicable.

How to Mitigate CVE-2025-3620

Immediate Actions Required

Update Google Chrome to version 135.0.7049.95 or later on all managed endpoints.
Restart Chrome after the update so the patched binaries are loaded into memory.
Validate version compliance using endpoint management tooling and quarantine non-compliant hosts.

Patch Information

Google released the fix in the Stable channel update for Desktop on April 15, 2025. Details are published in the Google Chrome Update Blog. Chromium-based browsers that share the same upstream code, such as Microsoft Edge and Brave, should be updated to the corresponding patched releases issued by their vendors.

Workarounds

Disable WebUSB via enterprise policy by setting DefaultWebUsbGuardSetting to 2 until patching is complete.
Restrict browsing to trusted sites through web filtering while the rollout is in progress.
Apply the WebUsbBlockedForUrls policy to block WebUSB access on high-risk URL patterns.

bash

# Configuration example - Chrome enterprise policy (Linux JSON policy)
# /etc/opt/chrome/policies/managed/disable_webusb.json
{
  "DefaultWebUsbGuardSetting": 2,
  "WebUsbBlockedForUrls": ["*"]
}