CVE-2025-13224
Published: 17 November 2025
Summary
CVE-2025-13224 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 13.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-13224 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine within Google Chrome versions prior to 142.0.7444.175. The flaw enables a remote attacker to potentially trigger heap corruption by means of a crafted HTML page. Chromium security has rated it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability over the network by luring a user into interacting with a malicious site, such as visiting a webpage or processing a crafted HTML document. User interaction is required to trigger the issue, after which the attacker could achieve heap corruption, leading to high-impact compromise of confidentiality, integrity, and availability.
Google's Chrome Releases blog announces a stable channel update for desktop in version 142.0.7444.175 that addresses this vulnerability. Additional technical details are documented in the Chromium issue tracker at https://issues.chromium.org/issues/450328966.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-197892
Vulnerability details
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a type confusion in Chrome's V8 engine exploitable via a crafted HTML page, enabling drive-by compromise (T1189) and exploitation for client execution (T1203) through user interaction like visiting a malicious site.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the type confusion vulnerability in Chrome's V8 engine by requiring identification, testing, and deployment of the vendor patch to version 142.0.7444.175 or later.
Implements memory protection mechanisms such as sandboxing, ASLR, and DEP that directly mitigate heap corruption resulting from V8 type confusion exploits.
Controls execution of mobile code like JavaScript from remote sources, reducing the risk of exploitation via crafted HTML pages targeting the V8 vulnerability.