Google Chrome zero-day CVE-2025-13223 is a type confusion vulnerability (CWE-843) in the V8 JavaScript engine that was actively exploited in the wild before a fix was released in November 2025. It is the seventh Chrome zero-day patched in 2025, following CVE-2025-2783 (sandbox escape, January) and CVE-2025-4664 (V8 use-after-free, July).
Key points
- The vulnerability: In V8, the JIT compiler can misidentify an object's type, causing memory corruption in the heap. Attackers need only lure a user to a malicious web page — no file downloads or privileges required.
- Severity: CVSS v3.1 score of 8.8 (High): network attack vector, low attack complexity, no privileges required, user interaction limited to visiting a site, and high impact on confidentiality, integrity, and availability.
- Discovery: Reported by Google's Threat Analysis Group (TAG) on November 12, 2025. TAG's involvement suggests targeting of high-value individuals, possibly by nation-state actors or commercial spyware vendors.
- Exploitation: Confirmed in-the-wild use. Multiple PoC versions have circulated on GitHub, though not yet achieving full remote code execution. SOCRadar reported a spike in automated scanning for unpatched Chrome instances after the patch release.
- Fix: Chrome stable channel updated to 142.0.7444.175 on November 17, 2025. Chromium-based browsers followed: Edge, Brave (Nov 18), Opera desktop and Android (Nov 20), and Linux distributions shipping Chromium packages.
- CISA response: Added to the Known Exploited Vulnerabilities Catalog, with a federal remediation deadline of December 8, 2025.
Technical background: type confusion in V8
V8 is a high-performance open-source engine (over 1 million lines of C++) that powers JavaScript across Chrome and most Chromium-based browsers. To speed execution, its JIT compiler dynamically infers object types. In CVE-2025-13223, insufficient validation of boundary conditions in object handling lets malicious input masquerade as a legitimate object, so the engine misreads property offsets via its hidden-class mechanism — allowing attackers to overwrite adjacent heap blocks and redirect code flow. Similar bugs (e.g., CVE-2019-5786, CVE-2024-4671) have historically been chained into sandbox escapes and watering-hole attacks.
Ecosystem impact
Because V8 is shared across Microsoft Edge, Brave, Opera, Vivaldi, and other Chromium browsers, the vulnerability affects far more than Chrome. Analysts (Tenable, AttackerKB) flagged it as exploitable; users were urged not to assume authentication requirements reduce risk. No confirmed impact on non-browser V8 consumers such as Node.js has been reported.
Mitigation
1. Check your version at chrome://version/; update if below 142.0.7444.175 (or edge://settings/help for Edge).
2. Enable automatic updates.
3. Enterprises: scan networks for vulnerable versions, deploy patches via WSUS/Jamf, monitor V8 crash logs (e.g., SIGSEGV heap errors), and use EDR tooling to detect sandbox-escape indicators.
4. Practice defense-in-depth: Site Isolation, ad/JS blockers (e.g., uBlock Origin), and browser isolation for high-risk tasks.
References
1. NVD – CVE-2025-13223 Detail 2. Google Chrome Releases: Stable Channel Update 3. Help Net Security: Google Patches Chrome Zero-Day 4. CISA Known Exploited Vulnerabilities Catalog 5. Microsoft Security Update Guide: CVE-2025-13223