Google Big Sleep AI Tool Finds Critical Chrome Vulnerability

Google has patched a critical graphics library vulnerability in the Chrome browser, discovered by its AI-powered detection tool, Google Big Sleep.

Google has released the Chrome Stable version 139.0.7258.154/.155 for Windows, macOS, and Linux, addressing a critical security vulnerability. Users are advised to update their browsers as the patch will roll out over the coming days.

The vulnerability known as CVE-2025-9478, a use-after-free issue in the ANGLE graphics library, was caught by Google’s own AI security tool, Big Sleep (aka Google Big Sleep). Rather than human researchers, this autonomous agent flagged the vulnerability on August 11, 2025 then human researchers at Google verified it before it was patched.

Use-after-free (UAF) (PDF) flaws occur when software references memory that has already been freed. This can lead to memory corruption or allow attackers to execute malicious code. In this case, a fake web page could trigger the vulnerability, compromising the security of a targeted device.

ANGLE is a core graphics component translating OpenGL ES calls to hardware APIs, which makes it a commonly used target in GPU‑accelerated contexts like WebGL or Canvas rendering.

The update improves memory handling in ANGLE and adds stronger safeguards to block similar flaws. Google plans to release Chrome 140 soon, but the current fix is already underway for most users.

Although the vulnerability was rated 9.8 on the CVSS scale, no signs of exploitation in the wild have been found yet, which makes this update especially timely.

Google’s “Big Sleep” is an AI-powered detection system created through collaboration between Google DeepMind and Project Zero. The tool is designed to automatically scan for previously unknown security vulnerabilities in widely used software, then report them for verification and patching. By combining automated analysis with human review, Big Sleep helps speed up the process of finding and fixing flaws before attackers can exploit them.

Make sure your Chrome browser is updated; either let it do so automatically or navigate to Help > About Chrome to trigger an immediate check. If you’re using another Chromium-based browser, Edge, Brave, Vivaldi, and others will likely follow with their own updates, as they use the same Chromium libraries