CVE-2025-5419
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Description
CVE-2025-5419 is a high-severity memory corruption vulnerability in Google Chrome's V8 JavaScript engine. The flaw involves out-of-bounds read and write operations in V8 that can be triggered by a crafted HTML page, potentially allowing a remote attacker to exploit heap corruption for arbitrary code execution. With a CVSS v3.1 base score of 8.8 (HIGH severity), the vulnerability is remotely exploitable through the network, though it requires user interaction in the form of visiting a malicious web page. CISA has added CVE-2025-5419 to the Known Exploited Vulnerabilities catalog, and its EPSS score of 2.11% at the 84th percentile indicates active exploitation in the wild. Google Chrome versions prior to 137.0.7151.68 and Microsoft Edge Chromium versions prior to 137.0.3296.62 are affected.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| chrome | < 137.0.7151.68 | |
| microsoft | edge chromium | < 137.0.3296.62 |
References
- https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html(Release Notes)
- https://issues.chromium.org/issues/420636529(Permissions Required)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5419(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5419(US Government Resource)
Weakness Type
CWE-125: Out-of-bounds Read
The out-of-bounds read weakness in CVE-2025-5419 allows the V8 JavaScript engine to read memory beyond the boundaries of an allocated buffer. In Google Chrome, this can be triggered by specially crafted JavaScript or WebAssembly code that causes the V8 engine to access memory locations outside the intended data structure, potentially leaking sensitive information from the browser process memory.
Learn more: CWE-125 — Out-of-bounds Read
CWE-787: Out-of-bounds Write
The out-of-bounds write weakness in CVE-2025-5419 allows the V8 JavaScript engine to write data beyond the boundaries of an allocated buffer. Combined with the out-of-bounds read (CWE-125), this creates a powerful heap corruption primitive that an attacker can leverage to gain arbitrary code execution within the Chrome renderer process by carefully controlling the written data and its location in memory.
Learn more: CWE-787 — Out-of-bounds Write
Impact Analysis
The impact of CVE-2025-5419 is severe with Confidentiality (High), Integrity (High), and Availability (High) all fully compromised. The vulnerability is network-accessible (AV:N) with low attack complexity (AC:L) and requires no privileges (PR:N), though user interaction (UI:R) is needed in the form of visiting a malicious web page. The combination of out-of-bounds read and write operations in V8 creates a powerful heap corruption primitive that can be leveraged for arbitrary code execution within the Chrome renderer sandbox. While the sandbox provides an additional defense layer, successful exploitation of heap corruption vulnerabilities in V8 has historically been combined with sandbox escape techniques for full system compromise. The EPSS score of 2.11% at the 84th percentile reflects active exploitation in the wild. Both Google Chrome and Microsoft Edge Chromium are affected due to their shared V8 engine.
Exploit Maturity
CVE-2025-5419 has confirmed active exploitation, as evidenced by CISA adding it to the Known Exploited Vulnerabilities catalog. The EPSS score of 2.11% at the 84th percentile indicates moderate but growing exploitation activity. No public proof-of-concept exploit has been tagged in the available references, and the Chromium bug tracker entry is access-restricted, following Google's standard practice of limiting vulnerability details until a majority of users have updated. Chrome V8 vulnerabilities are highly sought after by exploit developers due to Chrome's massive user base, and heap corruption vulnerabilities in V8 are frequently chained with sandbox escape exploits for full browser compromise. Microsoft Edge Chromium users are equally at risk due to the shared V8 engine.
Remediation
-
Update Google Chrome to version 137.0.7151.68 or later immediately. For Microsoft Edge users, update to version 137.0.3296.62 or later. Enable automatic updates on all managed browsers to ensure timely application of security patches. Verify the update has been applied by navigating to chrome://settings/help or edge://settings/help.
-
Enforce browser update policies in enterprise environments using group policy or MDM solutions. Configure Chrome Enterprise policies to require minimum browser versions and automatically restart browsers after updates are available.
-
Enable site isolation and V8 security features to limit the impact of V8 exploitation. Chrome's Site Isolation (enabled by default) helps contain renderer process compromises. Consider enabling Enhanced Safe Browsing for additional protection against known malicious pages.
-
Deploy web content filtering at the network level to block access to known malicious domains serving V8 exploits. Monitor DNS queries and web proxy logs for indicators of compromise associated with Chrome exploitation campaigns.
-
Consider deploying browser-level exploit protection through solutions that can detect and block heap corruption exploitation attempts in real-time. Windows Defender Exploit Guard and similar endpoint protection features can provide an additional defense layer against memory corruption attacks in browser processes.
Technical Details
CVE-2025-5419 is a heap corruption vulnerability in Google Chrome's V8 JavaScript engine involving both out-of-bounds read (CWE-125) and out-of-bounds write (CWE-787) operations. The CVSS v3.1 vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H indicates a network-accessible (AV:N), low-complexity (AC:L) attack requiring no privileges (PR:N) but requiring user interaction (UI:R) to visit a malicious page, with high impact across confidentiality, integrity, and availability. V8 is the JavaScript and WebAssembly engine at the core of Chrome and other Chromium-based browsers. The vulnerability is triggered when V8 processes specific JavaScript or WebAssembly code patterns that cause the engine to miscalculate memory buffer boundaries, resulting in reads and writes to memory locations outside the intended allocation. The out-of-bounds read allows the attacker to leak memory contents for address space layout randomization (ASLR) bypass, while the out-of-bounds write enables corruption of adjacent heap objects to achieve arbitrary code execution within the Chrome renderer process. A crafted HTML page can deliver the exploit payload through embedded JavaScript that triggers the vulnerable code path in V8. Chrome versions prior to 137.0.7151.68 and Microsoft Edge Chromium versions prior to 137.0.3296.62 are affected, as both browsers share the V8 engine.
Frequently Asked Questions
Is CVE-2025-5419 being actively exploited?
Yes, CISA has confirmed active exploitation by adding CVE-2025-5419 to the Known Exploited Vulnerabilities catalog. The EPSS score of 2.11% at the 84th percentile indicates active but relatively targeted exploitation. The Chromium bug details remain access-restricted following Google's standard disclosure policy.
What products are affected by CVE-2025-5419?
Google Chrome versions prior to 137.0.7151.68 and Microsoft Edge Chromium versions prior to 137.0.3296.62 are affected. Any Chromium-based browser using the vulnerable V8 engine version is potentially at risk.
How do I fix CVE-2025-5419?
Update Google Chrome to version 137.0.7151.68 or later, and Microsoft Edge to version 137.0.3296.62 or later. Enable automatic browser updates in enterprise environments and verify updates have been applied across all managed devices.
How severe is CVE-2025-5419?
CVE-2025-5419 is rated HIGH with a CVSS v3.1 score of 8.8. The out-of-bounds read and write in V8 can lead to heap corruption and potential arbitrary code execution when a user visits a malicious web page. The combination of CWE-125 and CWE-787 creates a powerful exploitation primitive.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.