CVE-2025-13630
Published: 02 December 2025
Summary
CVE-2025-13630 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-13630 is a type confusion vulnerability in the V8 JavaScript and WebAssembly engine within Google Chrome versions prior to 143.0.7499.41. This flaw allows a remote attacker to potentially exploit heap corruption through a crafted HTML page. Classified under CWE-843, it carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated High severity by Chromium security standards.
A remote attacker can exploit this vulnerability by tricking a user into visiting a malicious website hosting the crafted HTML page, as it requires user interaction but no special privileges. Successful exploitation could lead to heap corruption, enabling high-impact outcomes such as unauthorized access to sensitive data, modification of system integrity, or disruption of availability.
Mitigation is available via the stable channel update for Google Chrome desktop, detailed in the Chrome Releases blog at https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html, which patches the issue in version 143.0.7499.41. Additional details are tracked in the Chromium issue at https://issues.chromium.org/issues/456547591. Security practitioners should urge users to update to the latest version immediately.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200309
Vulnerability details
Type Confusion in V8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Type confusion in Chrome V8 exploited via crafted HTML on malicious site enables drive-by compromise (T1189) and client-side exploitation for execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Timely flaw remediation ensures installation of the Chrome update to 143.0.7499.41 or later, directly patching the V8 type confusion vulnerability and preventing heap corruption exploitation.
Vulnerability monitoring and scanning identifies systems running vulnerable Chrome versions prior to 143.0.7499.41 affected by this specific CVE.
Memory protection mechanisms such as ASLR and non-executable memory mitigate heap corruption resulting from the V8 type confusion flaw.