CVE-2025-0611
Published: 22 January 2025
Summary
CVE-2025-0611 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.2 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 29.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mandates timely remediation of the V8 object corruption flaw in Chrome via patching to version 132.0.6834.110 or later, preventing heap corruption exploitation.
Requires vulnerability scanning to identify systems running vulnerable Chrome versions affected by CVE-2025-0611, enabling proactive remediation.
Implements memory protections that mitigate heap corruption exploits from crafted HTML pages by restricting unauthorized code execution in V8.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Direct browser heap corruption in V8 via crafted HTML enables drive-by compromise (T1189) and client-side exploitation for execution (T1203).
NVD Description
Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2025-0611 is an object corruption vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 132.0.6834.110. The issue allows a remote attacker to potentially exploit heap corruption via a crafted HTML page, as rated High severity by the Chromium security team. It carries a CVSS v3.1 base score of 8.2 (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H) and is associated with CWE-122.
A remote attacker without privileges can exploit this vulnerability over the network with low complexity and no user interaction required, such as by luring a victim to visit a malicious website hosting the crafted HTML page. Exploitation could lead to heap corruption, enabling high availability impact alongside low integrity impact and no confidentiality impact.
Mitigation is addressed in the stable channel update documented at https://chromereleases.googleblog.com/2025/01/stable-channel-update-for-desktop_22.html, with the fix upstreamed in Chromium issue https://issues.chromium.org/issues/386143468. Security practitioners should ensure Google Chrome is updated to version 132.0.6834.110 or later.
Details
- CWE(s)