CVE-2025-0447
Published: 15 January 2025
Summary
CVE-2025-0447 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Privilege Escalation (T1068); ranked in the top 24.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2025-0447 involves an inappropriate implementation in the Navigation component of Google Chrome prior to version 132.0.6834.83. This flaw allows a remote attacker to achieve privilege escalation via a crafted HTML page. The vulnerability is associated with CWE-79 and carries a Chromium security severity rating of Low, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit the issue by luring a user to interact with a malicious site hosting the crafted HTML page, requiring user interaction such as clicking or navigating. Successful exploitation enables privilege escalation, resulting in high impacts to confidentiality, integrity, and availability.
Google addressed the vulnerability in the stable channel update for desktop Chrome 132.0.6834.83, as announced at https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_14.html. Further technical details are available in the Chromium issue tracker at https://issues.chromium.org/issues/375550814.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-1679
Vulnerability details
Inappropriate implementation in Navigation in Google Chrome prior to 132.0.6834.83 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Low)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Description explicitly states remote privilege escalation via crafted HTML page in browser navigation component, directly mapping to exploitation for privilege escalation.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation ensures patching of the specific inappropriate implementation in Chrome's Navigation component, directly eliminating the privilege escalation vulnerability.
Information input validation addresses the CWE-79-related failure in properly handling crafted HTML pages during navigation, preventing exploitation.
Process isolation enforces sandboxing in Chrome's multi-process architecture, limiting the impact of privilege escalation from compromised navigation handling.