PT-2025-44680 · Google+4 · Chromium+5

Published 2025-10-07 · Updated 2026-02-12 · CVE-2025-12433

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Chromium versions prior to 142.0.7444.59 Chromium versions 142.0.7444.59-1deb12u1 through 142.0.7444.59-1deb13u1

Description An issue exists in the V8 JavaScript engine component of Google Chrome and Microsoft Edge browsers. This is due to an improper implementation in V8, specifically related to security checks for standard elements. Exploitation of this issue could allow a remote attacker to gain unauthorized access to protected information through out-of-bounds memory access via a specially crafted HTML page. The issue is related to an invalid hole-check removal in the Ignition interpreter.

Recommendations Upgrade Chromium to version 142.0.7444.59 or later. Upgrade Chromium to version 142.0.7444.59-1deb12u1 for the oldstable distribution (bookworm). Upgrade Chromium to version 142.0.7444.59-1deb13u1 for the stable distribution (trixie). Upgrade Chromium to version 142.0.7444.162-alt0.p11.1.

Fix

Improperly Implemented Security Check for Standard

Weakness Enumeration

CWE-358

Related Identifiers

ALT-PU-2025-14702

AZL-70393

BDU:2025-14012

CVE-2025-12433

DSA-6046-1

OPENSUSE-SU-2025:15687-1

Affected Products

Alt Linux

Chromium

Debian

Google Chrome

Edge

Red Os

References · 53

• https://nvd.nist.gov/vuln/detail/CVE-2025-12433 · Security Note
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2026-0224SE18 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-70393 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-12433 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2025-12433 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-12433 · Security Note
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE172 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15687-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6046-1 · Vendor Advisory
• https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-14012 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-12433 · Vendor Advisory