CVE-2025-25000
Published: 04 April 2025
Summary
CVE-2025-25000 is a high-severity Type Confusion (CWE-843) vulnerability in Microsoft Edge Chromium. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 21.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2025-25000 is a type confusion vulnerability, tracked as CWE-843, that affects Microsoft Edge (Chromium-based). The flaw permits an unauthorized attacker to execute arbitrary code over a network and carries a CVSS 3.1 score of 8.8 reflecting network attack vector, low complexity, required user interaction, and high impact on confidentiality, integrity, and availability.
An unauthenticated remote attacker can exploit the issue by serving specially crafted web content that triggers the type confusion condition inside the browser. Successful exploitation grants the attacker the ability to run code in the context of the current user without needing prior credentials.
Microsoft has published an advisory for the vulnerability at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-25000 that addresses remediation steps. The associated EPSS score remains low, moving only from 0.0114 to a peak of 0.0182.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-9661
Vulnerability details
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.