CVE-2025-21279
Published: 06 February 2025
Summary
CVE-2025-21279 is a medium-severity Type Confusion (CWE-843) vulnerability in Microsoft Edge Chromium. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 24.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the RCE vulnerability by requiring timely application of Microsoft patches for the specific flaw in Edge as referenced in the update guide.
Provides defense-in-depth through malicious code protection mechanisms that detect and block exploit payloads targeting the browser RCE.
Identifies unpatched Edge installations vulnerable to this CVE via regular vulnerability scanning.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Browser RCE with UI:R enables drive-by compromise (T1189) and client-side exploitation for code execution (T1203).
NVD Description
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21279 is a Remote Code Execution vulnerability affecting Microsoft Edge (Chromium-based). Published on 2025-02-06, it has a CVSS v3.1 base score of 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N) and is associated with CWE-843 and NVD-CWE-noinfo.
Remote attackers can exploit this vulnerability over the network with low attack complexity and no privileges required, though user interaction is necessary. Successful exploitation enables high-impact confidentiality violations, such as unauthorized access to sensitive data, without affecting integrity or availability.
Microsoft has published an update guide with mitigation details for CVE-2025-21279 at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21279.
Details
- CWE(s)