PT-2025-32955 · Google+4 · V8+5

0X10N + 1 · Published 2025-08-12 · Updated 2025-11-11 · CVE-2025-8880

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 139.0.7258.127 Microsoft Edge (Chromium-based) versions prior to 139.0.7258.127

Description A race condition exists in the V8 JavaScript engine component of Google Chrome and Microsoft Edge. This issue can allow a remote attacker to execute arbitrary code within a sandbox by crafting a malicious HTML page. The root cause is synchronization errors when using a shared resource. Exploitation of this issue could allow an attacker to bypass security measures and gain control of the affected system. There is no information available regarding the number of potentially affected devices or any real-world incidents where this issue has been exploited.

Recommendations Update Google Chrome to version 139.0.7258.127 or later. Update Microsoft Edge to version 139.0.7258.127 or later.

Fix

RCE

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2025-10850

BDU:2025-10156

CVE-2025-8880

DSA-5976-1

OPENSUSE-SU-2025:15443-1

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Red Os

V8

References · 34

• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.html · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-8880 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8880 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8880 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15443-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-10156 · Security Note
• https://osv.dev/vulnerability/DSA-5976-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-8880 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://issues.chromium.org/issues/433533359 · Note
• https://twitter.com/xvonfers/status/1986554899031876034 · Twitter Post
• https://twitter.com/f8sbrightermind/status/1955502239742603674 · Twitter Post