Is the browser control affected by these CVE's, and is so, when can we expect an update?
---
Google Chrome versions prior to 134.0.6998.88 (Linux), 134.0.6998.88/.89 (Windows) and 134.0.6998.88/.89 (Mac)
---
Several vulnerabilities have been fixed in the Google Chrome browser. They allow an unauthenticated remote attacker:to execute arbitrary code,to cause a denial of service,to illegally take knowledge of potentially sensitive data,to compromise data integrity.Note: Google signals they are aware of an exploit for CVE-2025-24201. However, Cert-IST is not aware of any public exploit code.
---
These vulnerabilities are due to:CVE-2025-1920, CVE-2025-2135: type confusion issues in V8 leading to heap memory corruption. They allow an unauthenticated remote attacker, by tricking the user into opening a specially crafted HTML page, to cause a denial of service or execute arbitrary code. CVE-2025-2136: a use-after-free issue in Chromium's developer tools leading to heap memory corruption. It allows an unauthenticated remote attacker, by tricking the user into opening a specially crafted HTML page, to cause a denial of service or execute arbitrary code. CVE-2025-2137: an out-of-bounds read issue in V8. It allows an unauthenticated remote attacker, by tricking the user into opening a specially crafted HTML page, to compromise data confidentiality or cause a denial of service. CVE-2025-24201: an undetailed out-of-bounds write issue in the GPU. It allows an unauthenticated remote attacker to compromise data integrity or cause a denial of service.
---

---

-: I also have a udp joke, but you might not get it :-

I understand updating is a lot of work, but it is high time you do that. Chromium 126 is the version of June/July 2024. A year is a long time in software. I can fake the user agent, but it is still possible to see actual Chromium version with this command in Developer Tools:
navigator.userAgentData.getHighEntropyValues(["fullVersionList"]).then(console.log);
In the EO developer console, it returns data including this:
brands: Array(2)
0: {brand: 'Not/A)Brand', version: '8'}
1: {brand: 'Chromium', version: '126'}

Current stable Chromium version is 138 for all OS platforms and WebView. Only FuchsiaWebEngine is still older: 134.0.6998.221 (but still at a higher version than 134.0.6998.88).
See https://chromiumdash.appspot.com/releases?platform=Windows

Personally, I don't think these vulnerabilities will affect our -heavily sandboxed- product based on the EO browser control, but unfortunately security officers only look at the Chromium version :(