Cyber Resilience

CVE-2025-2135

High

Published: 10 March 2025

Published
10 March 2025
Modified
07 April 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0263 86.0th percentile
Risk Priority 19 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-2135 is a high-severity Type Confusion (CWE-843) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 14.0% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).

Deeper analysis

CVE-2025-2135 is a type confusion vulnerability in the V8 JavaScript engine within Google Chrome versions prior to 134.0.6998.88. The flaw, assigned CWE-843 and rated high severity by Chromium, can result in heap corruption when a victim visits a specially crafted HTML page.

A remote attacker can trigger the issue without authentication by serving malicious web content, potentially achieving arbitrary code execution or other impacts that affect confidentiality, integrity, and availability as reflected in the CVSS 8.8 score.

The referenced Chrome stable channel update and Chromium issue tracker entry indicate that the vulnerability was addressed by updating to version 134.0.6998.88 or later.

EPSS for the CVE rose materially from a low baseline to a peak of 0.0729 on 2026-04-19 before receding to the current value of 0.0263, indicating increased exploitation interest after disclosure.

EU & UK References

Vulnerability details

Type Confusion in V8 in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-843

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1189 Drive-by Compromise Initial Access
Adversaries may gain access to a system through a user visiting a website over the normal course of browsing.
attack.mitre.org →
T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
Why these techniques?

The type confusion vulnerability in Chrome's V8 JS engine enables remote code execution via a crafted HTML page visited by the user, directly facilitating drive-by compromise (T1189) and exploitation for client execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-6363Same product: Google Chrome
CVE-2026-8540Same product: Google Chrome
CVE-2025-1920Same product: Google Chrome
CVE-2025-0291Same product: Google Chrome
CVE-2025-0995Same product: Google Chrome
CVE-2026-2649Same product: Google Chrome
CVE-2025-2136Same product: Google Chrome
CVE-2025-0999Same product: Google Chrome
CVE-2026-9911Same product: Google Chrome
CVE-2026-6360Same product: Google Chrome

Affected Assets

google
chrome
≤ 134.0.6998.88

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Requires timely identification, reporting, and correction of flaws like the type confusion vulnerability in Chrome's V8 engine by applying patches such as version 134.0.6998.88.

SI-16 Memory Protection partial match
prevent

Implements memory safeguards to protect against unauthorized code execution stemming from heap corruption triggered by the type confusion exploit.

RA-5 Vulnerability Monitoring and Scanning partial match
preventdetect

Enables scanning for vulnerabilities like CVE-2025-2135 in Chrome installations and remediation within defined risk-based time frames.

References