CVE-2025-1006
Published: 19 February 2025
Summary
CVE-2025-1006 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 30.7% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-1006 is a use-after-free vulnerability (CWE-416) in the Network component of Google Chrome prior to version 133.0.6943.126. The flaw enables a remote attacker to potentially exploit heap corruption via a crafted web application. It carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated Medium severity by Chromium.
A remote attacker without privileges can exploit this over the network with low attack complexity, though it requires user interaction, such as clicking or visiting a malicious site. Successful exploitation could result in high impacts to confidentiality, integrity, and availability, potentially allowing heap corruption leading to arbitrary code execution or system compromise.
Google addressed the issue in Chrome stable channel update to version 133.0.6943.126. Details are provided in the Chrome Releases blog at https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html and the Chromium issue tracker at https://issues.chromium.org/issues/390590778. Security practitioners should prioritize updating affected browsers.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-4661
Vulnerability details
Use after free in Network in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted web app. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free RCE in browser network component directly enables drive-by compromise via malicious site and client-side exploitation for arbitrary code execution.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Mandates timely remediation of known flaws, such as patching Google Chrome to version 133.0.6943.126 or later to eliminate the use-after-free vulnerability in the Network component.
Provides memory protections like ASLR, DEP, and heap isolation that hinder exploitation of heap corruption from this use-after-free vulnerability.
Requires vulnerability scanning to identify systems running vulnerable Chrome versions prior to exploitation via crafted web applications.