PT-2025-30493 · Google+4 · Google Chrome+4

Shaheen Fazim · Published 2025-07-09 · Updated 2025-10-24 · CVE-2025-8011

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 138.0.7204.168 Microsoft Edge versions prior to 138.0.7204.168 Chromium versions prior to 138.0.7204.168 Chromium in Debian versions prior to 138.0.7204.168-1~deb12u1

Description A type confusion issue exists in the V8 JavaScript engine component used in Google Chrome, Microsoft Edge, and Chromium browsers. This issue could allow a remote attacker to potentially exploit heap corruption by crafting a malicious HTML page. Exploitation of this issue may lead to denial of service or, potentially, arbitrary code execution. The vulnerability is related to errors in data type conversion within the V8 engine.

Recommendations Google Chrome versions prior to 138.0.7204.168: Upgrade to version 138.0.7204.168 or later. Microsoft Edge versions prior to 138.0.7204.168: Upgrade to version 138.0.7204.168 or later. Chromium versions prior to 138.0.7204.168: Upgrade to version 138.0.7204.168 or later. Chromium in Debian versions prior to 138.0.7204.168-1deb12u1: Upgrade to version 138.0.7204.168-1deb12u1 or later.

Fix

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2025-9770

AZL-76332

BDU:2025-09418

CVE-2025-8011

DSA-5965-1

OPENSUSE-SU-2025:15375-1

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Red Os

References · 41

• https://safe-surf.ru/specialists/bulletins-nkcki/723280 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-8011 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8011 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5965-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15375-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-76332 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09418 · Security Note
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8011 · Vendor Advisory
• https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_22.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8011 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory