CVE-2025-13223
Google Chromium V8 Type Confusion Vulnerability
Description
CVE-2025-13223 is a high-severity type confusion vulnerability in Google Chrome's V8 JavaScript engine, affecting versions prior to 142.0.7444.175. The vulnerability allows a remote attacker to potentially exploit heap corruption by enticing a user to visit a crafted HTML page. With a CVSS v3.1 base score of 8.8, the type confusion in V8 can lead to arbitrary code execution within the browser's renderer process, potentially enabling sandbox escape when combined with additional vulnerabilities. CISA has added CVE-2025-13223 to the Known Exploited Vulnerabilities catalog with a remediation deadline of December 10, 2025, and the EPSS score of 2.12% at the 83.9th percentile reflects active exploitation in the wild targeting Chrome users.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 142.0.7444.175 | |
| siemens | cadra | - |
References
- https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html(Release Notes, Vendor Advisory)
- https://issues.chromium.org/issues/460017370(Issue Tracking, Permissions Required)
- https://cert-portal.siemens.com/productcert/html/ssa-470355.html(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-13223(US Government Resource)
Weakness Type
CWE-843: Type Confusion
CVE-2025-13223 is classified under CWE-843 (Access of Resource Using Incompatible Type), commonly known as type confusion. This vulnerability class occurs when a program accesses a resource using a type that is incompatible with the actual type of the resource, leading the program to interpret memory contents incorrectly. In the V8 JavaScript engine, type confusion vulnerabilities typically arise in the JIT (Just-In-Time) compiler or during object property access when the engine makes incorrect assumptions about the type of a JavaScript object. When V8 treats an object as a different type than it actually is, the resulting memory access pattern can read or write to unintended memory locations, corrupting heap structures and enabling arbitrary code execution. V8 type confusion bugs are consistently among the most impactful browser vulnerabilities due to V8's central role in JavaScript execution. Learn more about CWE-843
Impact Analysis
The exploitation of CVE-2025-13223 poses severe risk to Chrome users and, by extension, all Chromium-based browsers. Confidentiality is rated as high impact because successful heap corruption exploitation in V8 allows the attacker to read arbitrary memory within the renderer process. This memory may contain sensitive data from any web page in the same renderer process, including authentication tokens, form data, cookies, and other user information. If combined with a sandbox escape, the attacker gains access to the entire user profile and local system.
Integrity faces high impact as arbitrary code execution within the V8 engine allows the attacker to manipulate any data within the browser context, inject content into web pages, steal or modify form submissions, and execute unauthorized actions on websites where the user is authenticated.
Availability is also highly impacted since heap corruption can cause browser crashes, and controlled exploitation can lead to persistent denial of service through continuous crash-restart loops. The attack requires user interaction (UI:R) in the form of visiting a malicious or compromised web page, which is trivially achievable through phishing emails, malicious advertisements, or compromised legitimate websites. The EPSS score of 2.12% at the 83.9th percentile indicates that exploitation is actively occurring, and CISA's KEV inclusion confirms real-world attacks. While the ransomware association is classified as unknown, V8 type confusion vulnerabilities have historically been used in targeted espionage operations and commercial spyware campaigns.
Exploit Maturity
CVE-2025-13223 has been confirmed as actively exploited in the wild, as indicated by both CISA KEV inclusion and the Chromium security advisory. Google disclosed the vulnerability in a Chrome Stable Channel Update, which typically includes exploitation status information. The issue is tracked in the Chromium issue tracker, though access is restricted to prevent disclosure of exploitation details before users have updated.
The EPSS score of 2.12% at the 83.9th percentile places this in the top 17% of all vulnerabilities for exploitation probability. V8 type confusion vulnerabilities are among the most valuable browser exploits and have historically been exploited by nation-state actors, commercial surveillance vendors, and sophisticated criminal groups. The ransomware association is classified as unknown. The fact that Google rated this with "High" Chromium security severity and it was being exploited before the patch release indicates a zero-day or very rapid n-day exploitation scenario, making immediate patching critical.
Remediation
-
Update Google Chrome immediately to version 142.0.7444.175 or later. Chrome typically auto-updates, but administrators should verify the update has been applied across all managed endpoints. Force an update by navigating to chrome://settings/help or deploying the update through enterprise management tools.
-
Update all Chromium-based browsers including Microsoft Edge, Brave, Opera, Vivaldi, and any other browsers built on the Chromium engine. These browsers share the V8 JavaScript engine and are equally vulnerable until they incorporate the V8 fix from their respective upstream update channels.
-
Enable Site Isolation if not already active. Chrome's Site Isolation feature runs different websites in separate renderer processes, limiting the data an attacker can access through a V8 type confusion exploit to the same-origin context. Verify that Site Isolation is enabled by checking chrome://flags/#enable-site-per-process.
-
Implement browser management policies that ensure automatic updates are enabled and cannot be disabled by end users. Configure enterprise Chrome policies to enforce minimum version requirements and block access to sensitive resources from browsers running outdated versions.
-
Deploy network-level protections including DNS filtering and web proxy rules that block known malicious domains serving exploit pages. While this cannot prevent all exploitation vectors, it adds a defensive layer against known exploitation infrastructure.
Technical Details
CVE-2025-13223 is a type confusion vulnerability in V8, Google Chrome's JavaScript engine. The CVSS v3.1 vector string is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H, producing a base score of 8.8.
The vector breakdown describes a typical browser exploitation scenario. Attack Vector (AV:N) confirms remote exploitation through the network. Attack Complexity (AC:L) indicates reliable exploitation once the victim visits the attacker's page. Privileges Required (PR:N) confirms no authentication is needed. User Interaction (UI:R) requires the victim to navigate to or be redirected to a malicious web page containing the exploit payload. Scope (S:U) indicates the assessed impact is within the browser's V8 context, though sandbox escapes are possible with additional exploits. All three impact metrics are rated high.
The type confusion occurs within V8's handling of JavaScript objects. V8 uses various internal type representations and optimizations that depend on correctly identifying object types. When a code path causes V8 to misidentify the type of an object, it accesses the object's memory layout using the wrong type's expected structure. This discrepancy causes the engine to interpret fields at incorrect memory offsets, leading to heap corruption. An attacker can carefully construct JavaScript objects and trigger specific code paths to control the type confusion, gaining the ability to read and write arbitrary memory locations within the V8 heap. This primitive is then leveraged to execute arbitrary code within the Chrome renderer process. Chrome versions prior to 142.0.7444.175 contain the vulnerable V8 code.
Frequently Asked Questions
What is CVE-2025-13223?
CVE-2025-13223 is a type confusion vulnerability in Google Chrome's V8 JavaScript engine that can lead to heap corruption and arbitrary code execution. Exploitation requires the victim to visit a malicious web page crafted by the attacker.
Am I affected if I use a non-Chrome browser?
If you use a Chromium-based browser such as Microsoft Edge, Brave, Opera, or Vivaldi, you may also be affected since these browsers use the V8 JavaScript engine. Check your browser vendor's update channel for a corresponding security fix. Non-Chromium browsers like Firefox and Safari are not affected.
How is this vulnerability exploited?
The attacker creates a specially crafted HTML page containing JavaScript that triggers the type confusion in V8. When a user visits the page, the exploit corrupts heap memory in a controlled way that allows the attacker to execute arbitrary code within the browser's renderer process.
Was this a zero-day vulnerability?
CISA's addition to the KEV catalog and the Chromium security advisory confirm active exploitation in the wild. The details suggest exploitation was occurring before or shortly after the patch release, consistent with zero-day or rapid n-day exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.