PT-2025-33889 · Google +1 · V8 +2

Big Sleep · Published 2025-08-19 · Updated 2025-09-06 · CVE-2025-9132

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

**Name of the Vulnerable Software and Affected Versions:**

Google Chrome versions prior to 139.0.7258.138

Chromium versions prior to 139.0.7258.138

Debian Chromium versions prior to 139.0.7258.138-1~deb12u1 (bookworm)

Debian Chromium versions prior to 139.0.7258.138-1~deb13u1 (trixie)

**Description:**

An out-of-bounds write issue exists in the V8 JavaScript engine. This flaw allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, potentially leading to remote code execution. The vulnerability was discovered by Big Sleep AI from Google DeepMind and Project Zero.

**Recommendations:**

Google Chrome versions prior to 139.0.7258.138: Update to version 139.0.7258.138 or later.

Chromium versions prior to 139.0.7258.138: Update to version 139.0.7258.138 or later.

Debian Chromium versions prior to 139.0.7258.138-1~deb12u1 (bookworm): Upgrade to version 139.0.7258.138-1~deb12u1 or later.

Debian Chromium versions prior to 139.0.7258.138-1~deb13u1 (trixie): Upgrade to version 139.0.7258.138-1~deb13u1 or later.

Fix

DoS

RCE

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

CVE-2025-9132

DSA-5981-1

Affected Products

Debian

Google Chrome

V8

References · 39

• https://chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_19.html · Vendor Advisory
• https://security-tracker.debian.org/tracker/source-package/chromium · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-9132 · Security Note
• https://osv.dev/vulnerability/CVE-2025-9132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-9132 · Security Note
• https://osv.dev/vulnerability/DSA-5981-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/DSA-5981-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-9132 · Vendor Advisory
• https://issues.chromium.org/issues/436181695 · Note
• https://twitter.com/fernandokarl/status/1958054299772113106 · Twitter Post
• https://reddit.com/r/pwnhub/comments/1mvzz5j/critical_vulnerabilities_fixed_in_chrome_and · Reddit Post
• https://twitter.com/Cezar_H_Linux/status/1958937719985373586 · Twitter Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2025-9132 · Note
• https://twitter.com/alexjplaskett/status/1958046232351240310 · Twitter Post
• https://t.me/cveNotify/132852 · Telegram Post