CVE-2025-13229
Published: 18 November 2025
Description
Adversaries may exploit software vulnerabilities in client applications to execute code.
Security Summary
CVE-2025-13229 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine within Google Chrome versions prior to 142.0.7444.59. This flaw, classified under CWE-843, enables potential heap corruption when processing a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8, reflecting its high severity as rated by Chromium security.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page. No privileges are required (PR:N), and the attack is network-accessible (AV:N) with low complexity (AC:L), though it necessitates user interaction (UI:R). Successful exploitation could result in high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), potentially allowing arbitrary code execution or sandbox escape within the browser context.
Mitigation is available via the stable channel update to Google Chrome 142.0.7444.59 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html. Additional technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/446113731. Security practitioners should prioritize updating affected browsers and advise users to enable automatic updates.
Details
- CWE(s)
Affected Products
MITRE ATT&CK Enterprise Techniques
Why these techniques?
Type confusion in Chrome's V8 engine enables heap corruption via crafted HTML page on malicious website, directly facilitating drive-by compromise (T1189) and client-side exploitation for code execution (T1203).