CVE-2025-13223: high-severity vulnerability in Google Chrome
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
V8 (Chrome's JavaScript engine) has a type confusion vulnerability that lets attackers trick it into mishandling memory through a malicious webpage, potentially corrupting the heap and crashing or controlling the browser.
Type confusion in V8's type system allows a remote attacker to trigger heap corruption via crafted HTML, leading to potential code execution or denial of service. The attack requires user interaction (visiting a malicious page) and affects Chrome versions prior to 142.0.7444.175.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.