CVE-2025-13638CWE-416

CVE-2025-13638

High · published December 3, 2025

CVSS v3.1
8.8
EPSS
0%
Percentile
16.9
In the wild
Unconfirmed
What it is

⚡ A crafty HTML page can trigger a use-after-free vulnerability in Google Chrome pre-143.0.7499.41! This isn’t just a minor hiccup; it could lead to heap corruption! 🚨 Think of it like a restaurant where a waiter accidentally returns a dish that’s already been cleared — that leftover food can create quite a mess if someone tries to eat it again. If exploited, an attacker could potentially ruin the user's browser experience or even execute malicious code, leaving their data at risk. While it's not currently known to be exploited, the possibility of chaos is still present.

Put simply

Think of it like a restaurant where a waiter accidentally returns a dish that’s already been cleared — that leftover food can create quite a mess if someone tries to eat it again. This vulnerability arises from a use-after-free error in the Media Stream component of Google Chrome, which could lead to heap corruption when handling memory incorrectly after it has already been freed.

What to do

If exploited, an attacker could potentially ruin the user's browser experience or even execute malicious code, leaving their data at risk. While it's not currently known to be exploited, the possibility of chaos is still present. To protect yourself, update Google Chrome to version 143.0.7499.41 or later immediately. Regularly check and apply updates as they become available to ensure you’re shielded from similar vulnerabilities in the future. You've got this! Stay proactive and protect your browsing experience. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00261 · 16.9th percentile
Weakness
CWE-416 · Use After Free
Published
2025-12-03T00:15Z
Affected products (2)
ProductVersionsFixed in
google/chrome< 143.0.7499.40143.0.7499.40
google/chrome< 143.0.7499.40143.0.7499.40
References (2)
EPSS history
Timeline
  • 02 DEC 19:00Z
    Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5