CVE-2025-0434
Published: 15 January 2025
Summary
CVE-2025-0434 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 7.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SC-39 (Process Isolation) and SI-16 (Memory Protection).
Deeper analysis
CVE-2025-0434 is an out-of-bounds memory access vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 132.0.6834.83. The flaw, tracked under CWE-122 as a heap-based buffer overflow, permits heap corruption when a victim visits a specially crafted HTML page. It carries a CVSS 3.1 base score of 8.8 reflecting network attack vector, low complexity, and high impact on confidentiality, integrity, and availability.
A remote attacker can trigger the issue without authentication by serving malicious web content that the browser renders, potentially allowing arbitrary code execution or browser process compromise. User interaction is required in the form of visiting the attacker-controlled page.
The referenced Chrome stable channel update and Chromium issue tracker indicate that the vulnerability is resolved by upgrading to version 132.0.6834.83 or later. No information is provided on in-the-wild exploitation or additional mitigations such as configuration changes.
EPSS scores have remained essentially flat near 0.09 with only a negligible peak-to-current difference, offering no evidence of rising exploitation interest after disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1666
Vulnerability details
Out of bounds memory access in V8 in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct browser RCE via malicious webpage matches drive-by compromise and client-side exploitation techniques.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the V8 out-of-bounds memory access flaw by patching Google Chrome to version 132.0.6834.83 or later.
Implements memory protections like ASLR and DEP to block heap corruption exploitation from crafted HTML pages in the V8 engine.
Enforces process isolation through Chrome's sandbox to contain potential arbitrary code execution from V8 heap overflows within renderer processes.