PT-2025-47217 · Google +2 · Google Chrome +3

Published

2025-11-17

·

Updated

2025-12-07

·

CVE-2025-13223

CVSS v2.0
10
VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 142.0.7444.175 Chromium versions prior to 142.0.7444.175 Opera versions prior to 124.0.5705.42 Opera GX versions prior to 124.0.5705.38 Opera Air versions prior to 122.0.5643.196 Opera Neon versions prior to 124.0.5705.44 Opera for Android versions prior to 92.6 Microsoft Edge (Chromium-based) versions prior to 142.0.7444.175
Description A type confusion vulnerability exists in the V8 JavaScript and WebAssembly engine, specifically in Google Chrome and Chromium-based browsers. This flaw, tracked as CVE-2025-13223, allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. Exploitation of this vulnerability could lead to arbitrary code execution. This issue is actively being exploited in the wild, and an exploit is known to exist. The vulnerability stems from improper V8 object handling, giving attackers a path to remote code execution through malicious web pages. There have been reports of this vulnerability being used in targeted spyware campaigns.
Recommendations Update Google Chrome to version 142.0.7444.175 or later. Update Chromium-based browsers to version 142.0.7444.175 or later. Update Opera to version 124.0.5705.42 or later. Update Opera GX to version 124.0.5705.38 or later. Update Opera Air to version 122.0.5643.196 or later. Update Opera Neon to version 124.0.5705.44 or later. Update Opera for Android to version 92.6 or later. Update Microsoft Edge to version 142.0.7444.175 or later.

Fix

RCE

Type Confusion

Weakness Enumeration

CWE-843

Related Identifiers

ALT-PU-2025-15267
BDU:2025-14497
CVE-2025-13223
DSA-6060-1

Affected Products

Alt Linux
Debian
Google Chrome
V8