CVE-2025-21283
Published: 06 February 2025
Summary
CVE-2025-21283 is a medium-severity Insufficient Granularity of Address Regions Protected by Register Locks (CWE-1222) vulnerability in Microsoft Edge Chromium. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 38.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely identification, reporting, prioritization, and remediation of flaws like CVE-2025-21283 through vendor patches for Microsoft Edge.
Mandates monitoring and dissemination of security alerts and advisories, such as the MSRC update guide for this Edge RCE vulnerability, to enable prompt patching.
Requires vulnerability scanning and monitoring to identify systems running vulnerable versions of Chromium-based Microsoft Edge affected by this RCE flaw.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Browser RCE via malicious webpage directly maps to drive-by compromise (T1189) and client application exploitation for execution (T1203).
NVD Description
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Deeper analysisAI
CVE-2025-21283 is a remote code execution vulnerability in Microsoft Edge, the Chromium-based web browser. Published on 2025-02-06, it carries a CVSS v3.1 base score of 6.5, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, and is linked to CWE-1222 as well as NVD-CWE-noinfo.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity by tricking a user into some form of interaction, such as visiting a malicious webpage. Successful exploitation enables remote code execution within the browser's context, resulting in high confidentiality impact while having no integrity or availability effects.
Microsoft's Security Response Center has issued an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21283, where security practitioners and users are directed to apply the available patches to mitigate the issue.
Details
- CWE(s)