CVE-2025-13227CWE-843

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page

High · published November 17, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
16.7
In the wild
Unconfirmed
What it is

⚡ A crafty Type Confusion in V8 can lead to heap corruption just by visiting a malicious HTML page! 🥴 Think of it like a restaurant that serves both delectable desserts and dangerous dishes, but the server can’t tell the difference and accidentally mixes them up — one wrong order could leave someone with a bad taste in their mouth, or worse! An attacker could exploit this vulnerability to corrupt memory on your machine, leading to crashes or, in the worst-case scenario, executing arbitrary code. This could open the door for serious exploits, leaving your system vulnerable to further attacks!

Put simply

Think of it like a restaurant that serves both delectable desserts and dangerous dishes, but the server can’t tell the difference and accidentally mixes them up — one wrong order could leave someone with a bad taste in their mouth, or worse! This Type Confusion vulnerability in the V8 engine allows a remote attacker to exploit heap corruption by delivering specially crafted HTML content, ultimately compromising the integrity of the browser's memory management.

What to do

An attacker could exploit this vulnerability to corrupt memory on your machine, leading to crashes or, in the worst-case scenario, executing arbitrary code. This could open the door for serious exploits, leaving your system vulnerable to further attacks! Update Google Chrome to version 142.0.7444.59 or later immediately to patch this vulnerability. Regularly review your browser’s security settings, and consider enabling sandboxing features to enhance protection. 🛡️ You've got this! Keep your browser updated and you'll be safeguarding your digital space like a pro! 💪✨

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00259 · 16.7th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-11-17T23:19Z
EPSS history
Timeline
  • 17 NOV 23:19Z
    Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5