CVE-2025-13230CWE-843

Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page

High · published November 17, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
16.4
In the wild
Unconfirmed
What it is

⚡ A well-crafted HTML page is all it takes to exploit this sneaky type confusion in V8! Before you know it, heap corruption could let attackers wreak havoc. 🔥 Think of this like a restaurant where the chef accidentally mixes up the ingredients. Instead of using flour for the pastry, they end up with a mysterious substance that ruins the dish entirely. A similar mix-up in the V8 engine can lead to disaster when it comes to memory management! An attacker could exploit this vulnerability to cause heap corruption, potentially leading to unauthorized access or execution of arbitrary code. This could compromise sensitive user data or even take over the affected browser entirely!

Put simply

Think of this like a restaurant where the chef accidentally mixes up the ingredients. Instead of using flour for the pastry, they end up with a mysterious substance that ruins the dish entirely. A similar mix-up in the V8 engine can lead to disaster when it comes to memory management! The type confusion flaw in V8 allows remote attackers to send specially crafted HTML that the engine mishandles, leading to memory corruption. This flaw is primarily due to improper type handling within the JavaScript engine.

What to do

An attacker could exploit this vulnerability to cause heap corruption, potentially leading to unauthorized access or execution of arbitrary code. This could compromise sensitive user data or even take over the affected browser entirely! Update Google Chrome to version 142.0.7444.59 or later immediately to close this vulnerability. Additionally, consider enabling automatic updates to ensure you are always protected against future threats. You've got this! By staying informed and proactive, you'll keep your browsing safe and secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00257 · 16.4th percentile
Weakness
CWE-843 · Access of Resource Using Incompatible Type ('Type Confusion')
Published
2025-11-17T23:19Z
EPSS history
Timeline
  • 17 NOV 23:19Z
    Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5