CVE-2025-0997
Published: 15 February 2025
Summary
CVE-2025-0997 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 24.6th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
SI-2 mandates timely flaw remediation, directly requiring patching of Chrome to version 133.0.6943.98 or later to eliminate the use-after-free vulnerability.
CM-11 enforces organizational policies on user-installed software, preventing installation of crafted Chrome Extensions that trigger the Navigation component vulnerability.
SI-16 implements memory protections such as hardened allocators and isolation to mitigate heap corruption exploitation from the use-after-free defect.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Navigation component directly enables client-side exploitation via malicious extension for arbitrary memory operations.
NVD Description
Use after free in Navigation in Google Chrome prior to 133.0.6943.98 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: High)
Deeper analysisAI
CVE-2025-0997 is a use-after-free vulnerability (CWE-416) in the Navigation component of Google Chrome prior to version 133.0.6943.98. This defect enables potential heap corruption when triggered by a crafted Chrome Extension. Published on 2025-02-15, it carries a CVSS v3.1 base score of 8.1 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N) and is rated High severity by Chromium security.
A remote attacker can exploit this vulnerability without user privileges by luring a victim into some form of interaction, such as installing or interacting with a malicious Chrome Extension. Successful exploitation allows the attacker to achieve high-impact confidentiality and integrity violations through heap corruption, potentially enabling arbitrary memory read and write operations, though without direct denial-of-service effects.
Chrome's stable channel update to version 133.0.6943.98 resolves this issue, as detailed in the release notes at https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_12.html. Further technical details are available in the Chromium bug tracker at https://issues.chromium.org/issues/391666328. Security practitioners should prioritize updating affected Chrome installations to mitigate the risk.
Details
- CWE(s)