CVE-2025-12727
Published: 10 November 2025
Description
Inappropriate implementation in V8 in Google Chrome prior to 142.0.7444.137 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Mitigating Controls (NIST 800-53 r5)AI
Requires timely identification, reporting, and correction of the V8 heap corruption flaw by patching Google Chrome to version 142.0.7444.137 or later.
Implements memory safeguards such as address space layout randomization and data execution prevention to protect against heap corruption from out-of-bounds writes in V8.
Mandates vulnerability scanning to identify systems running vulnerable Chrome versions prior to 142.0.7444.137, enabling proactive remediation.
Security SummaryAI
CVE-2025-12727 stems from an inappropriate implementation in the V8 JavaScript engine within Google Chrome prior to version 142.0.7444.137. This vulnerability enables a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium rates its security severity as High, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), and it maps to CWE-787 (Out-of-bounds Write).
A remote attacker without privileges can exploit this by luring a user to interact with a malicious site hosting the crafted HTML page. User interaction is required, but no authentication is needed, allowing network-accessible exploitation with low complexity. Successful attacks could result in high impacts to confidentiality, integrity, and availability through heap corruption.
Mitigation involves updating to Google Chrome 142.0.7444.137 or later, as detailed in the stable channel update on the Chrome Releases blog (https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html) and the associated Chromium issue (https://issues.chromium.org/issues/454485895).
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability in the V8 JavaScript engine allows remote exploitation of heap corruption via a crafted HTML page, directly enabling Exploitation for Client Execution (T1203).