CVE-2025-13721CWE-362

CVE-2025-13721

High · published December 3, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
10.8
In the wild
Unconfirmed
What it is

⚡ A crafty HTML page can trigger heap corruption in Google Chrome, and this vulnerability could be the entry point for attackers to exploit! 🚨 Think of it like a restaurant kitchen where a sneaky chef slips in a bad ingredient into the sauce without anyone noticing. One wrong mix, and the entire dish can be ruined, potentially poisoning the whole dining experience! If exploited, this vulnerability could allow an attacker to corrupt the heap, leading to unexpected behavior or even system crashes. That's right—hackers could potentially gain control of your browser environment, leaving you vulnerable to more serious attacks!

Put simply

Think of it like a restaurant kitchen where a sneaky chef slips in a bad ingredient into the sauce without anyone noticing. One wrong mix, and the entire dish can be ruined, potentially poisoning the whole dining experience! This race condition in the V8 engine allows an attacker to exploit heap corruption via a specially crafted HTML page. This happens when the browser mishandles memory allocation, leading to vulnerabilities that can be manipulated.

What to do

If exploited, this vulnerability could allow an attacker to corrupt the heap, leading to unexpected behavior or even system crashes. That's right—hackers could potentially gain control of your browser environment, leaving you vulnerable to more serious attacks! To protect yourself, update Google Chrome to version 143.0.7499.41 or later immediately. Encourage your users to do the same, and consider implementing monitoring tools for unusual behaviors. 🛡️ Security hero status: activated! You've got this! Keep your systems safe and sound! 💪😊

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.8th percentile
Weakness
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')
Published
2025-12-03T00:15Z
Affected products (2)
ProductVersionsFixed in
google/chrome< 143.0.7499.40143.0.7499.40
google/chrome< 143.0.7499.41143.0.7499.41
References (2)
EPSS history
Timeline
  • 02 DEC 19:00Z
    Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page
    cvelistv5