Cyber Resilience

CVE-2025-0611

High

Published: 22 January 2025

Published
22 January 2025
Modified
18 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H
EPSS Score 0.0064 71.0th percentile
Risk Priority 17 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-0611 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 29.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Deeper analysis

CVE-2025-0611 is an object corruption vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 132.0.6834.110. The flaw, assigned CWE-122, can result in heap corruption when a victim visits a specially crafted HTML page, carrying a CVSS 3.1 base score of 8.2 reflecting network attack vector, low complexity, and impacts limited to integrity and availability.

A remote attacker can trigger the issue without user interaction or authentication by serving a malicious web page, potentially allowing heap manipulation that leads to denial-of-service or limited integrity violations within the renderer process.

The referenced Chrome stable channel update and Chromium issue tracker entry indicate that the vulnerability is resolved by upgrading to version 132.0.6834.110 or later.

EPSS scores for the CVE rose from a starting value of 0.0064 to a peak of 0.0109, signaling modest but measurable growth in exploitation interest after disclosure.

EU & UK References

Vulnerability details

Object corruption in V8 in Google Chrome prior to 132.0.6834.110 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-122

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

Direct browser heap corruption in V8 via crafted HTML enables drive-by compromise (T1189) and client-side exploitation for execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2025-0999Same product: Google Chrome
CVE-2026-2650Same product: Google Chrome
CVE-2025-1426Same product: Google Chrome
CVE-2025-0434Same product: Google Chrome
CVE-2026-2648Same product: Google Chrome
CVE-2026-6361Same product: Google Chrome
CVE-2025-0995Same product: Google Chrome
CVE-2026-2649Same product: Google Chrome
CVE-2025-2136Same product: Google Chrome
CVE-2026-9911Same product: Google Chrome

Affected Assets

google
chrome
≤ 132.0.6834.110

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mandates timely remediation of the V8 object corruption flaw in Chrome via patching to version 132.0.6834.110 or later, preventing heap corruption exploitation.

RA-5 Vulnerability Monitoring and Scanning good match
detect

Requires vulnerability scanning to identify systems running vulnerable Chrome versions affected by CVE-2025-0611, enabling proactive remediation.

SI-16 Memory Protection partial match
prevent

Implements memory protections that mitigate heap corruption exploits from crafted HTML pages by restricting unauthorized code execution in V8.

References