Chrome Zero-Day CVE-2025-13223: V8 Type Confusion Vulnerability Exploited in the Wild

Forum topic · ✨步子哥 · 2025-11-30

Summary

Google patched a high-severity zero-day vulnerability, CVE-2025-13223, in Chrome's V8 JavaScript engine on November 17, 2025, marking the seventh Chrome zero-day fix of the year. The type confusion flaw (CWE-843), scored 8.8 on CVSS v3.1, was reported by Google's Threat Analysis Group (TAG) and is confirmed to be exploited in the wild, reportedly targeting high-value individuals such as journalists and politicians. Exploitation requires only that a victim visit a malicious web page: the flaw lets attackers corrupt heap memory in the JIT-compiled V8 engine, potentially chaining to arbitrary code execution, data theft, and spyware deployment. Because V8 powers all Chromium-based browsers, fixes rolled out to Microsoft Edge, Brave, Opera, and Vivaldi alongside Chrome stable 142.0.7444.175. CISA added the bug to its Known Exploited Vulnerabilities Catalog, requiring US federal agencies to patch by December 8, 2025. Users should verify their browser version and enable automatic updates immediately.

Chrome Zero-Day CVE-2025-13223: V8 Type Confusion Under Active Attack

In November 2025, Google issued an emergency update for CVE-2025-13223, a type confusion vulnerability (CWE-843) in Chrome's V8 JavaScript engine that is confirmed to be exploited in the wild. This is the seventh Chrome zero-day patched in 2025, following CVE-2025-2783 (sandbox escape, January) and CVE-2025-4664 (V8 use-after-free, July).

What Is the Vulnerability?

V8 is the high-performance open-source engine that executes JavaScript in Chrome. In CVE-2025-13223, the JIT compiler mishandles object types — effectively treating one object as another — which corrupts heap memory. An attacker who crafts a malicious web page can trigger this misidentification to overwrite critical data structures.

Key facts:

CVE: CVE-2025-13223 (CWE-843, Type Confusion)
CVSS v3.1: 8.8 (High) — network attack vector, low complexity, no privileges required, user interaction limited to visiting a site
Reported by: Google Threat Analysis Group (TAG), November 12, 2025
Patched: November 17, 2025, in Chrome stable 142.0.7444.175 (Beta and Dev channels followed)
Status: Actively exploited in the wild; CISA added it to the Known Exploited Vulnerabilities Catalog with a federal remediation deadline of December 8, 2025

Google TAG's investigation indicates this is not a supply-chain attack but a genuine zero-day hunt, potentially linked to state-sponsored APT groups or commercial spyware vendors targeting high-value individuals such as journalists and politicians. According to Security Affairs, at least three proof-of-concept versions have circulated on GitHub — enough for less-skilled attackers to build on, though not yet full remote code execution.

Impact

Successful exploitation corrupts the heap, potentially overwriting vtables to hijack code execution. An attack chain typically begins with a phishing link or waterhole site; the malicious JavaScript triggers the type confusion, and attackers can then steal cookies and credentials, deploy keyloggers, or install spyware — all without requiring any privileges beyond a page visit. Researchers note that chaining with a companion bug, CVE-2025-13224 (discovered by Google's Big Sleep AI), could enable full system compromise.

Chromium Ecosystem-Wide Patching

Because V8 is shared across Chromium-based browsers, the fix propagated broadly:

| Browser | Patch date | Notes | |---------|-----------|-------| | Chrome | Nov 17, 2025 | Stable 142.0.7444.175 | | Brave | Nov 18, 2025 | Confirmed fixed | | Microsoft Edge | via MSRC | Verify at edge://settings/help | | Opera (incl. GX, Air) | Nov 20, 2025 | Desktop and Android | | SUSE Linux | Nov 18, 2025 | Chromium packages |

CVE Details reports no evidence that non-browser V8 consumers such as Node.js are affected.

How to Protect Yourself

1. Check your version at chrome://version/ — if below 142.0.7444.175, update immediately (Settings > About Chrome on Windows/macOS, or sudo apt update on Linux). 2. Enable automatic updates so patches install without delay. 3. For enterprises: scan networks for vulnerable builds, push patches via WSUS/Jamf, monitor for anomalous V8 crashes (SIGSEGV heap errors), and deploy EDR to catch sandbox-escape indicators. 4. General hardening: use Site Isolation, avoid untrusted sites, filter malicious scripts (e.g., uBlock Origin), and consider browser isolation/VMs for high-risk browsing.

Context: An Accelerating Zero-Day Trend

Chrome zero-days have grown from 5 in 2024 to 7 in 2025. The driver is the expanding V8 codebase (over 1 million lines of C++) combined with increasingly sophisticated attackers using AI-assisted fuzzing. Post-patch, SOCRadar observed a surge (~30%) in automated scanning for unpatched Chrome instances.

References

1. NVD – CVE-2025-13223 Detail: https://nvd.nist.gov/vuln/detail/CVE-2025-13223 2. Google Chrome Releases – Stable Channel Update: https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html 3. Help Net Security – Google Patches Chrome Zero-Day: https://www.helpnetsecurity.com/2025/11/18/chrome-cve-2025-13223-exploited/ 4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-13223 5. Microsoft Security Update Guide – CVE-2025-13223: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-13223