CVE-2025-5419KEV · OVERDUE

Google Chromium V8 Out-of-Bounds Read and Write Vulnerability

High · published June 2, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 94.7th percentile for exploit probability.

485
days past CISA
deadline
CVSS v3.1
8.8
EPSS
8%
Percentile
94.7
In the wild
Confirmed
What it is

🚨 An out-of-bounds read and write in V8 can turn your browser into a playground for attackers! This vulnerability affects Google Chrome versions prior to 137.0.7151.68. 🔥 Think of it like a restaurant that accidentally serves the wrong dish to customers. Instead of just delivering food, it hands out secret recipes straight from the chef's desk—an open invitation to chaos! If exploited, attackers could potentially corrupt memory on your device, leading to data leaks or even remote code execution! That's like letting a stranger into your home who can rearrange all your furniture without you knowing—absolutely devastating!

Put simply

Think of it like a restaurant that accidentally serves the wrong dish to customers. Instead of just delivering food, it hands out secret recipes straight from the chef's desk—an open invitation to chaos! This vulnerability allows remote attackers to exploit heap corruption through a specially crafted HTML page, enabling them to read or write memory locations they shouldn't have access to.

What to do

If exploited, attackers could potentially corrupt memory on your device, leading to data leaks or even remote code execution! That's like letting a stranger into your home who can rearrange all your furniture without you knowing—absolutely devastating! Immediately update Google Chrome to version 137.0.7151.68 or later to close this security gap. It's also a great idea to regularly review your browser settings and security features to maintain your defenses! You've got this! Stay proactive in your security game, and you'll surf the web safely in no time! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.07821 · 94.7th percentile
Published
2025-06-02T23:36Z
KEV added
2025-06-05 · due 2025-06-26
EPSS history
Timeline
  • 05 JUN 00:00Z
    Added to CISA KEV — remediate by Jun 26
    kev
  • 02 JUN 23:36Z
    Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML…
    cvelistv5