CVE-2025-13223KEV · OVERDUE

Google Chromium V8 Type Confusion Vulnerability

High · published November 17, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 92.1th percentile for exploit probability.

318
days past CISA
deadline
CVSS v3.1
8.8
EPSS
5%
Percentile
92.1
In the wild
Confirmed
What it is

🚨 A crafted HTML page can unleash heap corruption in Google Chrome versions prior to 142.0.7444.175! Talk about opening Pandora's box! 🔥 Imagine your favorite restaurant serving a dish that looks delicious, but is actually made with spoiled ingredients—one bite and it could ruin your entire meal. This type confusion flaw in V8 is like that, where a hacker serves a deceptive page that misleads the browser, leading to chaos in memory. An attacker could exploit this vulnerability to manipulate memory and potentially execute arbitrary code. This means they could gain access to sensitive data or even hijack the browsing session, putting users' information at serious risk. It's a high-stakes game where the wrong click could spell disaster!

Put simply

Imagine your favorite restaurant serving a dish that looks delicious, but is actually made with spoiled ingredients—one bite and it could ruin your entire meal. This type confusion flaw in V8 is like that, where a hacker serves a deceptive page that misleads the browser, leading to chaos in memory. This vulnerability stems from type confusion in the V8 JavaScript engine, allowing malicious actors to corrupt the heap memory by injecting misleading data through specially crafted HTML pages.

What to do

An attacker could exploit this vulnerability to manipulate memory and potentially execute arbitrary code. This means they could gain access to sensitive data or even hijack the browsing session, putting users' information at serious risk. It's a high-stakes game where the wrong click could spell disaster! Update Google Chrome immediately to version 142.0.7444.175 or later to mitigate this vulnerability. Additionally, keep an eye on alerts from your browser for any further security updates that may arise. Regularly educate users to avoid clicking suspicious links! You can handle this! Apply the updates and keep your browsing experience safe and sound. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.04900 · 92.1th percentile
Published
2025-11-17T23:03Z
KEV added
2025-11-19 · due 2025-12-10
EPSS history
Timeline
  • 19 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 10
    kev
  • 17 NOV 23:03Z
    Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5