CVE-2025-13229
Published: 18 November 2025
Summary
CVE-2025-13229 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 25.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Deeper analysis
CVE-2025-13229 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine within Google Chrome versions prior to 142.0.7444.59. This flaw, classified under CWE-843, enables potential heap corruption when processing a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8, reflecting its high severity as rated by Chromium security.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website or opening a crafted HTML page. No privileges are required (PR:N), and the attack is network-accessible (AV:N) with low complexity (AC:L), though it necessitates user interaction (UI:R). Successful exploitation could result in high-impact confidentiality, integrity, and availability violations (C:H/I:H/A:H), potentially allowing arbitrary code execution or sandbox escape within the browser context.
Mitigation is available via the stable channel update to Google Chrome 142.0.7444.59 or later, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html. Additional technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/446113731. Security practitioners should prioritize updating affected browsers and advise users to enable automatic updates.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-197890
Vulnerability details
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion in Chrome's V8 engine enables heap corruption via crafted HTML page on malicious website, directly facilitating drive-by compromise (T1189) and client-side exploitation for code execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly mandates timely remediation of the V8 type confusion flaw by applying the Chrome update to version 142.0.7444.59 or later.
Vulnerability scanning identifies systems with vulnerable Chrome versions prior to 142.0.7444.59, enabling prioritized patching.
Memory protection controls like address randomization and stack guards mitigate heap corruption exploitation from the V8 type confusion.