⚠ Actively exploited
Added to CISA KEV on 2025-11-19. Federal agencies required to patch by 2025-12-10. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..
CVE-2025-13223 — Type Confusion in Google Chrome
Severity
8.8HIGHNVD
EPSS
2.8%
top 13.86%
CISA KEV
KEV
Added 2025-11-19
Due 2025-12-10
Exploit
No known exploits
Affected products
Timeline
PublishedNov 17
KEV addedNov 19
KEV dueDec 10
Latest updateJan 14
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Description
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9