Cyber Resilience

CVE-2025-0434

HighPublic PoC

Published: 15 January 2025

Published
15 January 2025
Modified
21 April 2025
KEV Added
Patch
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0943 93.0th percentile
Risk Priority 23 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0434 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-0434 is an out-of-bounds memory access vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 132.0.6834.83. The flaw, tracked under CWE-122 as a heap-based buffer overflow, permits heap corruption when a victim visits a specially crafted HTML page. It carries a CVSS 3.1 base score of 8.8 reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.

A remote attacker can trigger the issue without authentication by serving malicious web content that the browser renders, potentially allowing arbitrary code execution or browser process compromise. User interaction is required in the form of visiting the attacker-controlled page.

The referenced Chrome stable channel update and Chromium issue tracker indicate that the vulnerability is resolved by upgrading to version 132.0.6834.83 or later. No information is provided on in-the-wild exploitation or additional mitigations such as configuration changes.

EPSS scores have remained essentially flat near 0.09 with only a negligible peak-to-current difference, offering no evidence of rising exploitation interest after disclosure.

EU & UK References

Vulnerability details

Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CWE(s)

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

Direct browser RCE via malicious webpage matches drive-by compromise and client-side exploitation techniques.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-0999Same product: Google Chrome
CVE-2026-2650Same product: Google Chrome
CVE-2025-1426Same product: Google Chrome
CVE-2025-0611Same product: Google Chrome
CVE-2026-2648Same product: Google Chrome
CVE-2026-6361Same product: Google Chrome
CVE-2025-0995Same product: Google Chrome
CVE-2026-2649Same product: Google Chrome
CVE-2025-2136Same product: Google Chrome
CVE-2026-9911Same product: Google Chrome

Affected Assets

google
chrome
≤ 132.0.6834.83

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

prevent

Directly mandates timely remediation of the V8 out-of-bounds memory access flaw by patching Google Chrome to version 132.0.6834.83 or later.

prevent

Implements memory protections like ASLR and DEP to block heap corruption exploitation from crafted HTML pages in the V8 engine.

prevent

Enforces process isolation through Chrome's sandbox to contain potential arbitrary code execution from V8 heap overflows within renderer processes.

References