CVE-2025-1426

CVE-2025-1426 is a heap buffer overflow vulnerability, classified under CWE-122, affecting the GPU component in Google Chrome on Android versions prior to 133.0.6943.126. Published on 2025-02-19, it enables potential heap corruption when a user processes a crafted HTML page. The Chromium security team assesses it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though it relies on user interaction, such as visiting a malicious site. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability through heap corruption.

Google's stable channel update addresses the issue in Chrome for Android 133.0.6943.126 and later versions, as detailed in the Chrome Releases blog and Chromium issue tracker (https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html, https://issues.chromium.org/issues/383465163). Security practitioners should prioritize updating affected devices to mitigate the risk.