CVE-2025-8576
Published: 07 August 2025
Summary
CVE-2025-8576 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 49.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-16 (Memory Protection).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly mitigates the use-after-free vulnerability by requiring timely installation of Chrome updates to version 139.0.7258.66 or later.
Prevents exploitation by blocking or restricting user installation of crafted malicious Chrome Extensions.
Implements memory safeguards like ASLR and DEP to protect against heap corruption from use-after-free in Chrome Extensions.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
UAF in Chrome Extensions enables RCE via crafted malicious extension requiring user install/engagement (T1204.002), directly supporting client-side exploitation (T1203).
NVD Description
Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)
Deeper analysisAI
CVE-2025-8576 is a use-after-free vulnerability (CWE-416) in the Extensions component of Google Chrome prior to version 139.0.7258.66. Published on 2025-08-07, it enables potential heap corruption when processing a crafted Chrome Extension. Chromium rates its security severity as Medium, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction such as installing or engaging with the malicious extension. Successful exploitation could grant high-impact access to confidential data, modification of system integrity, and disruption of availability, potentially through heap corruption leading to code execution.
Google's stable channel update for desktop Chrome to version 139.0.7258.66 resolves the issue, as detailed in the Chrome Releases blog at chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html. Additional technical information is available in the Chromium bug tracker at issues.chromium.org/issues/414760982.
Details
- CWE(s)