CVE-2025-12725CWE-125

CVE-2025-12725

High · published November 11, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
18.2
In the wild
Unconfirmed
What it is

⚡ A crafty crafted HTML page can lead to a sneaky out of bounds memory write in WebGPU on Google Chrome for Android! 🔥 It's like a waiter serving a dish that was never ordered—one bite could spoil the entire meal. This vulnerability allows attackers to slip extra ingredients into the mix without any oversight, potentially ruining your data's integrity. An attacker could exploit this vulnerability to manipulate memory, which could lead to system crashes or even unauthorized data access. Imagine a rogue chef fiddling with the recipe in the kitchen—it's not just risky, it's downright dangerous!

Put simply

It's like a waiter serving a dish that was never ordered—one bite could spoil the entire meal. This vulnerability allows attackers to slip extra ingredients into the mix without any oversight, potentially ruining your data's integrity. This out of bounds read vulnerability in WebGPU allows a remote attacker to write to invalid memory locations via a specially crafted HTML page, impacting the security and stability of the application.

What to do

An attacker could exploit this vulnerability to manipulate memory, which could lead to system crashes or even unauthorized data access. Imagine a rogue chef fiddling with the recipe in the kitchen—it's not just risky, it's downright dangerous! Update Google Chrome for Android to version 142.0.7444.137 or later to close this vulnerability. Regularly review and update your browser to ensure protection against newly discovered flaws. You've got this! Patch it up and keep your browsing safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00270 · 18.2th percentile
Weakness
CWE-125 · Out-of-bounds Read
Published
2025-11-11T01:15Z
Affected products (3)
ProductVersionsFixed in
google/chrome< 142.0.7444.137142.0.7444.137
google/chrome< 142.0.7444.134142.0.7444.134
google/chrome< 142.0.7444.135142.0.7444.135
References (2)
EPSS history
Timeline
  • 10 NOV 20:00Z
    Out of bounds read in WebGPU in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker to perform an out of bounds memory write via a…
    cvelistv5