Google

Google’s Project Zero team has announced a new policy, effective July 29, 2025, to increase transparency around software vulnerabilities. Under this trial policy, Project Zero will publicly report the discovery of a new vulnerability within one week of notifying the affected vendor or project.

In a groundbreaking development for cybersecurity, Google has announced that its artificial intelligence agent successfully identified and thwarted an attempt to exploit a previously unknown critical vulnerability. This marks the first known instance in which an AI system proactively prevented the exploitation of a zero-day vulnerability, underscoring the growing role of artificial intelligence in safeguarding digital infrastructure.

Google has released urgent security updates for Chrome to address a critical zero-day vulnerability, CVE-2025-6554, which is actively being exploited in the wild. This flaw is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine, the core component responsible for running JavaScript in Chrome and other Chromium-based browsers.

Google has implemented a multi-layered defense strategy to secure its generative AI systems (like Gemini) from evolving threats, particularly indirect prompt injection attacks. These attacks involve embedding malicious instructions within external data sources—such as emails, documents, or calendar invites—to manipulate AI into exfiltrating sensitive data or performing unauthorized actions. Unlike direct prompt injections, where attackers input malicious commands explicitly, indirect injections exploit trusted content to bypass defenses.