CVE-2025-5419highunder attackCWE-125 CWE-787

CVE-2025-5419: high-severity vulnerability in Google Chrome

Published 02 Jun 2025 · Updated 26 Feb 2026

73Vexday Risk Score

Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.

ssvc Actcvss 8.8epss 7.8%

from disclosure to weapon12 days

Published on NVDJun 2

1st PoC+12d

CISA KEV+3d

exploitation probability

7.8%top 5% of all CVEs

observed exploitation

yesCISA + VulnCheck

6 public exploit(s)

What the vendors declare (VEX)

Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.

Red HatVEX document ↗

Not affected

1 product — because the vulnerable code is not present in the product

red_hat_products

Action required by CISAfederal deadline: 2025-06-26

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

In short

Google Chrome had a bug in its V8 engine that allowed attackers to read and write data outside intended memory boundaries through a specially crafted webpage, potentially crashing the browser or executing malicious code.

Technical detail

Out-of-bounds read/write vulnerability in V8 engine (CWE-125, CWE-787) exploitable via crafted HTML; requires user to visit malicious page; impacts heap integrity and may lead to arbitrary code execution or denial of service.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

Google · Chrome

public PoCs found — 6