CVE-2025-13227
published 2025-11-18CVE-2025-13227: Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page…
PriorityP349high8.8CVSS 3.1
AVNACLPRNUIRSUCHIHAH
EPSS
0.24%
15.7th percentile
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 142.0.7444.59-1~deb12u1 | 142.0.7444.59-1~deb12u1 |
| chromium | chromium | >= 0 < 142.0.7444.59-1~deb13u1 | 142.0.7444.59-1~deb13u1 |
| chromium | chromium | >= 0 < 142.0.7444.59-1 | 142.0.7444.59-1 |
| debian | chromium | < chromium 142.0.7444.59-1~deb12u1 (bookworm) | chromium 142.0.7444.59-1~deb12u1 (bookworm) |
| chrome | < 142.0.7444.59 | 142.0.7444.59 | |
| chrome | < 142.0.7444.60 | 142.0.7444.60 | |
| chrome | >= 142.0.7444.59 < 142.0.7444.59 | 142.0.7444.59 | |
| chrome_chrome | — | — | |
| msrc | azl3_nodejs_20.14.0-10_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-13_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-14_on_azure_linux_3.0 | — | — |
| msrc | azl3_nodejs_20.14.0-9_on_azure_linux_3.0 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
osv8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
vendor_msrc8.6HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
chromium-browser: Type Confusion in V8
vendor_redhat·2025-11-17·CVSS 8.8
CVE-2025-13227 [HIGH] CWE-843 chromium-browser: Type Confusion in V8
chromium-browser: Type Confusion in V8
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Microsoft
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
vendor_msrc·2025-11-11·CVSS 8.6
CVE-2025-13227 [HIGH] CWE-843 Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Mariner: Mariner
Chrome: Chrome
Customer Action Required: Yes
Chrome
Stable Channel Update for Desktop: CVE-2025-13226
vendor_chrome·2025-10-28·CVSS 8.8
CVE-2025-13226 [HIGH] Stable Channel Update for Desktop: CVE-2025-13226
Stable Channel Update for Desktop
CVE-2025-13226: Type Confusion in V8. Reported by Seunghyun Lee (@0x10n) on 2025-09-19 [$55000][ 446122633 ] High CVE-2025-13227: Type Confusion in V8
Reported by Seunghyun Lee (@0x10n) on 2025-09-19 [$55000][ 446124893 ] High CVE-2025-13228: Type Confusion in V8
Severity: high
Debian
CVE-2025-13227: chromium - Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote at...
vendor_debian·2025·CVSS 8.8
CVE-2025-13227 [HIGH] CVE-2025-13227: chromium - Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote at...
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Scope: local
bookworm: resolved (fixed in 142.0.7444.59-1~deb12u1)
bullseye: open
forky: resolved (fixed in 142.0.7444.59-1)
sid: resolved (fixed in 142.0.7444.59-1)
trixie: resolved (fixed in 142.0.7444.59-1~deb13u1)
GHSA
GHSA-cwff-vvrc-985j: Type Confusion in V8 in Google Chrome prior to 142
ghsa_unreviewed·2025-11-18
CVE-2025-13227 [HIGH] CWE-843 GHSA-cwff-vvrc-985j: Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
OSV
CVE-2025-13227: Type Confusion in V8 in Google Chrome prior to 142
osv·2025-11-18·CVSS 8.8
CVE-2025-13227 [HIGH] CVE-2025-13227: Type Confusion in V8 in Google Chrome prior to 142
Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-18
Published