CVE-2025-13633CWE-416

CVE-2025-13633

High · published December 3, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
34.1
In the wild
Unconfirmed
What it is

🚨 A crafty HTML page could lead to heap corruption in Google Chrome, making this vulnerability a sneaky threat for users on versions prior to 143.0.7499.41! ⚡ Think of it like a restaurant where a chef accidentally serves food that’s been left out too long—one wrong ingredient could spoil the entire dish! It’s a recipe for disaster, and in this case, it’s the renderer process that’s at risk. If an attacker successfully exploits this vulnerability, they could cause unpredictable behavior in the browser, potentially allowing them to execute arbitrary code. Imagine a hacker slipping in through the back door and running amok in your kitchen; they could access sensitive information or even control your system! This could lead to data breaches or system compromise—yikes!

Put simply

Think of it like a restaurant where a chef accidentally serves food that’s been left out too long—one wrong ingredient could spoil the entire dish! It’s a recipe for disaster, and in this case, it’s the renderer process that’s at risk. This use-after-free vulnerability in Digital Credentials allows a remote attacker to exploit heap corruption by manipulating how memory is handled after it's been freed. If this occurs, it can disrupt normal operations and enable malicious actions.

What to do

If an attacker successfully exploits this vulnerability, they could cause unpredictable behavior in the browser, potentially allowing them to execute arbitrary code. Imagine a hacker slipping in through the back door and running amok in your kitchen; they could access sensitive information or even control your system! This could lead to data breaches or system compromise—yikes! Update Google Chrome to version 143.0.7499.41 or higher immediately to eliminate this risk. Regularly check for updates to ensure you’re using the most secure version. Additionally, consider implementing strict content security policies to enhance your defense against such exploits. You've got this! By updating your browser, you’re one step closer to a more secure internet experience. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00409 · 34.1th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-03T00:15Z
Affected products (2)
ProductVersionsFixed in
google/chrome< 143.0.7499.40143.0.7499.40
google/chrome< 143.0.7499.40143.0.7499.40
References (2)
EPSS history
Timeline
  • 02 DEC 19:03Z
    Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially…
    cvelistv5