Cyber Resilience

CVE-2025-8576

High

Published: 07 August 2025

Published
07 August 2025
Modified
13 November 2025
KEV Added
—
Patch
—
CVSS Score v3.1 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0075 73.6th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-8576 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked in the top 26.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 CM-11 (User-installed Software) and SI-16 (Memory Protection).

Deeper analysis

CVE-2025-8576 is a use-after-free vulnerability (CWE-416) in the Extensions component of Google Chrome prior to version 139.0.7258.66. Published on 2025-08-07, it enables potential heap corruption when processing a crafted Chrome Extension. Chromium rates its security severity as Medium, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).

A remote attacker without privileges can exploit this vulnerability over the network with low complexity, though it requires user interaction such as installing or engaging with the malicious extension. Successful exploitation could grant high-impact access to confidential data, modification of system integrity, and disruption of availability, potentially through heap corruption leading to code execution.

Google's stable channel update for desktop Chrome to version 139.0.7258.66 resolves the issue, as detailed in the Chrome Releases blog at chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop.html. Additional technical information is available in the Chromium bug tracker at issues.chromium.org/issues/414760982.

EU & UK References

Vulnerability details

Use after free in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to potentially exploit heap corruption via a crafted Chrome Extension. (Chromium security severity: Medium)

CWE(s)
CWE-416

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
attack.mitre.org →
T1204.002 Malicious File Execution
An adversary may rely upon a user opening a malicious file in order to gain execution.
attack.mitre.org →
Why these techniques?

UAF in Chrome Extensions enables RCE via crafted malicious extension requiring user install/engagement (T1204.002), directly supporting client-side exploitation (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

CVEs Like This One

CVE-2026-5287Same product: Apple Macos
CVE-2026-4458Same product: Apple Macos
CVE-2026-7349Same product: Apple Macos
CVE-2026-3922Same product: Apple Macos
CVE-2026-2321Same product: Apple Macos
CVE-2026-7347Same product: Apple Macos
CVE-2025-11460Same product: Apple Macos
CVE-2025-8578Same product: Apple Macos
CVE-2025-11756Same product: Apple Macos
CVE-2026-7338Same product: Apple Macos

Affected Assets

google
chrome
≤ 139.0.7258.66

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-2 Flaw Remediation good match
prevent

Directly mitigates the use-after-free vulnerability by requiring timely installation of Chrome updates to version 139.0.7258.66 or later.

CM-11 User-installed Software good match
prevent

Prevents exploitation by blocking or restricting user installation of crafted malicious Chrome Extensions.

SI-16 Memory Protection good match
prevent

Implements memory safeguards like ASLR and DEP to protect against heap corruption from use-after-free in Chrome Extensions.

References