CVE-2025-13633
Published: 02 December 2025
Summary
CVE-2025-13633 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 28.1th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-13633 is a use-after-free vulnerability (CWE-416) in the Digital Credentials component of Google Chrome prior to version 143.0.7499.41. The flaw enables a remote attacker who has compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. Chromium security rates it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though user interaction is necessary, such as rendering a malicious HTML page in the browser. Assuming prior compromise of the renderer process, successful exploitation leads to heap corruption, enabling high-impact effects on confidentiality, integrity, and availability.
Google's Chrome stable channel update to version 143.0.7499.41 and later addresses the issue, as detailed in the Chrome Releases blog post at https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html and Chromium issue tracker entry at https://issues.chromium.org/issues/458082926. Security practitioners should prioritize updating affected Chrome installations.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200302
Vulnerability details
Use after free in Digital Credentials in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Chrome renderer exploited via crafted HTML page enables drive-by compromise (T1189) and exploitation for client execution (T1203) with remote access, low complexity, and user interaction via browser rendering.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Requires timely remediation of identified flaws, such as patching Google Chrome to version 143.0.7499.41 or later, to eliminate the use-after-free vulnerability.
Implements memory protections like ASLR, DEP, and heap isolation to prevent exploitation of use-after-free leading to heap corruption in the renderer process.
Enforces process isolation for browser renderer processes to limit the scope of compromise and mitigate escalation from use-after-free heap corruption.