CVE-2025-13226CWE-843

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page

High · published November 17, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

⚡ A crafty type confusion bug lurks in Google Chrome's V8 engine, waiting for an opportunistic attacker to exploit it via a crafted HTML page! Think of this as a waiter who mistakenly serves a dessert marked ‘vegan’ but actually contains dairy — if you don't check the label, you could end up with a stomachache. This vulnerability can lead to heap corruption, mixing data types in ways that shouldn't happen, much like mixing ingredients that spoil the recipe. An attacker could potentially manipulate your browser's memory, leading to unexpected crashes or worse, allowing them to execute malicious code. This could result in leaking sensitive data or taking control of your browsing session! Absolutely devastating for your online security!

Put simply

Think of this as a waiter who mistakenly serves a dessert marked ‘vegan’ but actually contains dairy — if you don't check the label, you could end up with a stomachache. This vulnerability can lead to heap corruption, mixing data types in ways that shouldn't happen, much like mixing ingredients that spoil the recipe. This type confusion vulnerability in V8 allows improper handling of data types, potentially leading to heap corruption. If successfully exploited, an attacker can run arbitrary code within the context of the affected browser.

What to do

An attacker could potentially manipulate your browser's memory, leading to unexpected crashes or worse, allowing them to execute malicious code. This could result in leaking sensitive data or taking control of your browsing session! Absolutely devastating for your online security! Update Google Chrome to version 142.0.7444.59 or later immediately to patch this issue. Regularly check for updates to ensure you’re protected against such vulnerabilities! You've got this! Stay proactive, and keep your browser safe! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-11-17T23:19Z
EPSS history
Timeline
  • 17 NOV 23:19Z
    Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5