CVE-2025-12438CWE-416

CVE-2025-12438

High · published November 11, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
17.0
In the wild
Unconfirmed
What it is

🚨 A crafty use-after-free vulnerability lurks in Ozone for Google Chrome on Linux and ChromeOS versions before 142.0.7444.59! This means a remote attacker could potentially exploit object corruption just by tricking you into viewing a specially designed HTML page. ⚡ Think of this like a restaurant where the chef accidentally leaves a pot of boiling soup unattended. If someone sneaks in and plays around with the pot, they might spill it everywhere, causing a major mess! That's akin to how this vulnerability can let an attacker cause chaos in your system by manipulating freed objects. If exploited, this vulnerability could lead to object corruption, allowing attackers to execute arbitrary code on your machine. Imagine an intruder gaining the ability to access sensitive data or disrupt your browsing experience — absolutely devastating!

Put simply

Think of this like a restaurant where the chef accidentally leaves a pot of boiling soup unattended. If someone sneaks in and plays around with the pot, they might spill it everywhere, causing a major mess! That's akin to how this vulnerability can let an attacker cause chaos in your system by manipulating freed objects. This use-after-free vulnerability occurs when Ozone in Google Chrome fails to properly manage memory, allowing an attacker to manipulate freed objects through a crafted HTML page, potentially leading to system instability or code execution.

What to do

If exploited, this vulnerability could lead to object corruption, allowing attackers to execute arbitrary code on your machine. Imagine an intruder gaining the ability to access sensitive data or disrupt your browsing experience — absolutely devastating! To protect yourself, update your Google Chrome to version 142.0.7444.59 or later right away! Additionally, consider reviewing your security settings and enabling enhanced protection features to guard against unknown threats. You've got this! 🛡️ By following these steps, you'll be taking a giant leap towards securing your browsing experience!

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00262 · 17.0th percentile
Weakness
CWE-416 · Use After Free
Published
2025-11-11T01:15Z
Affected products (1)
ProductVersionsFixed in
google/chrome< 142.0.7444.59142.0.7444.59
References (2)
EPSS history
Timeline
  • 10 NOV 20:00Z
    Use after free in Ozone in Google Chrome on Linux and ChromeOS prior to 142.0.7444.59 allowed a remote attacker to potentially exploit object corruption via a…
    cvelistv5