CVE-2025-2136
Published: 10 March 2025
Summary
CVE-2025-2136 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked in the top 42.5% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of flaws like this use-after-free vulnerability through patching to Chrome 134.0.6998.88 or later.
Implements controls specifically designed to minimize the impact of use-after-free memory exploits such as heap corruption in Chrome's Inspector.
Enforces process isolation, such as browser sandboxing, to limit the scope of heap corruption exploitation from a crafted HTML page.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in Chrome Inspector enables RCE via crafted malicious HTML page, directly mapping to drive-by compromise and client-side exploitation techniques.
NVD Description
Use after free in Inspector in Google Chrome prior to 134.0.6998.88 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)
Deeper analysisAI
CVE-2025-2136 is a use-after-free vulnerability (CWE-416) in the Inspector component of Google Chrome prior to version 134.0.6998.88. It enables a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue carries a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H) and is rated Medium severity by Chromium security standards.
A remote attacker without privileges can exploit this over the network with low attack complexity, though it requires user interaction, such as loading a malicious HTML page in the browser. Successful exploitation could result in high impacts to confidentiality, integrity, and availability through heap corruption, potentially allowing arbitrary code execution.
Mitigation is available in Google Chrome version 134.0.6998.88 and later, as outlined in the stable channel update advisory at https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_10.html. Further technical details are provided in the Chromium issue tracker at https://issues.chromium.org/issues/395032416. Practitioners should prioritize updating affected systems.
Details
- CWE(s)