Cyber Posture

CVE-2025-13227

High

Published: 18 November 2025

Published
18 November 2025
Modified
19 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0009 24.8th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Description

Adversaries may exploit software vulnerabilities in client applications to execute code.

Security Summary

A type confusion vulnerability, designated CVE-2025-13227, affects the V8 JavaScript engine in Google Chrome prior to version 142.0.7444.59. Published on 2025-11-18, it enables a remote attacker to potentially trigger heap corruption via a crafted HTML page. The issue carries a Chromium security severity of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), classified under CWE-843.

Exploitation requires no privileges and can be initiated remotely over the network with low complexity, though it depends on user interaction, such as visiting a malicious site. An attacker could achieve heap corruption, leading to high-impact confidentiality, integrity, and availability violations, potentially allowing arbitrary code execution within the renderer process.

Chrome's stable channel update, documented at https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html, patches this by advancing to version 142.0.7444.59. Additional details are available in the Chromium issue tracker at https://issues.chromium.org/issues/446122633. Mitigation involves updating to the patched Chrome version promptly.

Details

CWE(s)
CWE-843

Affected Products

google
chrome
≤ 142.0.7444.59 · ≤ 142.0.7444.60

MITRE ATT&CK Enterprise Techniques

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

The vulnerability is a type confusion in Chrome's V8 engine exploitable via crafted HTML on a malicious site, enabling drive-by compromise (T1189) and exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

References