CVE-2025-13720
Published: 02 December 2025
Summary
CVE-2025-13720 is a high-severity Incorrect Type Conversion or Cast (CWE-704) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 23.4th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and SC-39 (Process Isolation).
Deeper analysis
CVE-2025-13720 is a bad cast vulnerability (CWE-704) in the Loader component of Google Chrome prior to version 143.0.7499.41. This flaw allows potential heap corruption when processing a crafted HTML page, with Chromium assigning it a Medium security severity.
A remote attacker who has compromised the renderer process can exploit this vulnerability via a malicious HTML page. The CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) indicates network-accessible exploitation with low complexity and no privileges required, but user interaction is needed, such as visiting a crafted webpage, potentially leading to high impacts on confidentiality, integrity, and availability.
Mitigation is available through the Google Chrome stable channel update for desktop, as announced at https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html. Additional technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/457818670. Affected systems should be updated to Chrome 143.0.7499.41 or later.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-200305
Vulnerability details
Bad cast in Loader in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Vulnerability enables heap corruption in Chrome renderer via crafted HTML page, directly facilitating drive-by compromise (T1189) and exploitation for client execution (T1203).
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly remediates the bad cast vulnerability in Chrome's Loader component by requiring timely patching to version 143.0.7499.41 or later.
Provides memory protections like ASLR and DEP to mitigate heap corruption exploitation from the bad cast in the renderer process.
Enforces process isolation for the renderer to contain potential heap corruption impacts even if the renderer is compromised via crafted HTML.