CVE-2025-12438
Published: 10 November 2025
Description
Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: Medium)
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the use-after-free vulnerability by identifying, testing, and applying the specific patch released in Chrome version 142.0.7444.59.
Provides memory safety mechanisms like ASLR and DEP that prevent successful exploitation of the Ozone use-after-free leading to object corruption.
Enforces process isolation in Chrome's renderer to contain object corruption from the Ozone vulnerability and limit compromise scope.
Security SummaryAI
CVE-2025-12438 is a use-after-free vulnerability (CWE-416) in the Ozone component of Google Chrome on Linux and ChromeOS versions prior to 142.0.7444.59. It enables a remote attacker to potentially exploit object corruption through a crafted HTML page. Chromium rates the severity as Medium, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or interacting with a crafted HTML page, requiring no privileges. Successful exploitation could lead to high-impact compromise of confidentiality, integrity, and availability, such as object corruption that might enable arbitrary code execution within the browser's renderer process.
Google's stable channel update advisory at https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html announces patches for Chrome versions reaching 142.0.7444.59 on affected platforms. The Chromium issue tracker at https://issues.chromium.org/issues/433027577 provides further details on the fix, recommending users update to the patched version to mitigate the vulnerability.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome's Ozone component exploited via crafted HTML page matches Drive-by Compromise (T1189), enabling remote code execution in the browser renderer process through malicious websites.