CVE-2025-21283
Microsoft Edge Chromium ≤ 133.0.3065.51
Raw vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSummary
CVE-2025-21283 is a medium-severity Insufficient Granularity of Address Regions Protected by Register Locks (CWE-1222) vulnerability in Microsoft Edge Chromium. Its CVSS base score is 6.5 (Medium).
Operationally, exploitation aligns with the MITRE ATT&CK technique System Firmware (T1542.001); ranked in the top 29% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to AC-3 (Access Enforcement) and CM-5 (Access Restrictions for Change) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-21283 is a remote code execution vulnerability in Microsoft Edge, the Chromium-based web browser. Published on 2025-02-06, it carries a CVSS v3.1 base score of 6.5, with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N, and is linked to CWE-1222 as well as NVD-CWE-noinfo.
An unauthenticated remote attacker can exploit this vulnerability over the network with low attack complexity by tricking a user into some form of interaction, such as visiting a malicious webpage. Successful exploitation enables remote code execution within the browser's context, resulting in high confidentiality impact while having no integrity or availability effects.
Microsoft's Security Response Center has issued an update guide at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-21283, where security practitioners and users are directed to apply the available patches to mitigate the issue.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2348
Vulnerability Data
Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Access restrictions for change require documented, approved controls on configuration modifications, which cannot be satisfied by an insufficiently granular lock.
Access enforcement requires approved authorizations to be applied at the granularity needed for each resource, directly countering an overly broad lock region.
Security engineering principles include least privilege and isolation, which must be applied when designing register lock regions.
Security function isolation requires that protection mechanisms be separated from modifiable resources at a sufficiently fine granularity.
System partitioning into separate domains forces address regions to be isolated at the granularity required by their differing protection needs.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Configuration management can enforce proper lock settings but does not address coarse hardware region design.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Secure architecture principles require appropriate granularity of protection mechanisms, directly addressing the register-lock design flaw.
Configuration management can enforce fine-grained lock settings but does not guarantee hardware register granularity.
Secure coding practices can avoid overly coarse lock regions but do not define the hardware protection model itself.
Change-management processes can review lock configurations, yet the weakness is a hardware-design issue outside runtime change control.