CVE-2025-1426
Published: 19 February 2025
Summary
CVE-2025-1426 is a high-severity Heap-based Buffer Overflow (CWE-122) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 39.8% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly remediates the specific heap buffer overflow in Chrome's GPU by requiring timely patching to version 133.0.6943.126 or later.
Implements memory protections like ASLR and DEP to prevent unauthorized access and exploitation of heap buffer overflows in the GPU process.
Scans for vulnerable Chrome versions affected by the GPU heap overflow, enabling identification and prioritization for remediation.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Heap buffer overflow in browser GPU enables remote code execution via crafted HTML page, directly supporting drive-by compromise (T1189) and exploitation for client execution (T1203).
NVD Description
Heap buffer overflow in GPU in Google Chrome on Android prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2025-1426 is a heap buffer overflow vulnerability, classified under CWE-122, affecting the GPU component in Google Chrome on Android versions prior to 133.0.6943.126. Published on 2025-02-19, it enables potential heap corruption when a user processes a crafted HTML page. The Chromium security team assesses it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker can exploit this vulnerability over the network with low attack complexity and no privileges required, though it relies on user interaction, such as visiting a malicious site. Successful exploitation could lead to high impacts on confidentiality, integrity, and availability through heap corruption.
Google's stable channel update addresses the issue in Chrome for Android 133.0.6943.126 and later versions, as detailed in the Chrome Releases blog and Chromium issue tracker (https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html, https://issues.chromium.org/issues/383465163). Security practitioners should prioritize updating affected devices to mitigate the risk.
Details
- CWE(s)