November 2025 - Technical Report CVE-2025-12725)

Google has released an emergency security patch for the Chrome web browser (CVE-2025-12725) which addresses a flaw that enables Remote Code Execution (RCE). This update should be installed at your earliest convenience. 

The BlackCloak Concierge Team is ready to assist with this update. While this alert is a proactive notification for our Champions, we are sending an alert regarding this item to the remainder of our member base this afternoon based on the severity of the vulnerability. Our team will be ready to support any requests for assistance with implementing this update.

Chrome downloads security updates in the background, but it will not install them until the application is completely closed and reopened. If you have kept your browser open for several days or weeks, often done to save many tabs, you are still running the vulnerable version.

Actions Recommended For All Members:

1. Quit and reopen the Chrome application - your open tabs will reload after you reboot Chrome

   1. Windows users: Right-click the Chrome icon on your taskbar and select "Close window" for every instance of Chrome running. 

   2. Mac users: Go to the top-left menu bar, click the "Chrome" menu, and select "Quit Google Chrome." Alternatively, right-click on the Chrome icon in your dock, and select QUIT. 

2. Relaunch Chrome a minute or so after quitting. The patch will install as the browser restarts.

3. Repeat the above steps on each computer. 

If Auto-Updates Are Disabled

If the Group Policy Object (GPO), Intune, or other management system is set to control or block Chrome's default automatic update behavior, an immediate, mandatory patch push is required.

1. Prioritize Deployment: Push the 142.0.7444.134/.135 patch (or later) to all managed endpoints immediately. This deployment must be categorized as a critical security patch.

2. Enforce Restart: The patch is inactive until the browser is fully closed and reopened. We must use our management tools to enforce this final step.

• GPO/SCCM: Utilize deployment scripts or forced policy updates to ensure the Chrome application is killed and relaunched on all user sessions.

• Recommendations: Do not rely on end-users to manually complete the restart; automate the execution of the final update stage.

If Default Auto-Updates Are Active

If auto-updates by Chrome are not disabled by managed device policy, the core issue is user behavior (keeping the browser open).

1. Targeted Communication: Send a highly visible message to all end-users specifically instructing them to manually quit and relaunch Chrome to finalize the patch installation.

2. Monitoring: Monitor update status across your fleet. Identify users running a version lower than 142.0.7444.134 and take direct action to remediate their individual endpoints.

The BlackCloak Concierge Team is ready to assist. You can reach us at (833) 882-5625, ask@blackcloak.io, or schedule a session here: https://blackcloak.io/concierge-portal/