⚠ Actively exploited
Added to CISA KEV on 2025-06-05. Federal agencies required to patch by 2025-06-26. Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable..

CVE-2025-5419 — Out-of-bounds Read in Google Chrome

CWE-125 — Out-of-bounds ReadCWE-787 — Out-of-bounds Write10 documents10 sources
Severity
8.8HIGHNVD
EPSS
3.3%
top 12.85%
CISA KEV
KEV
Added 2025-06-05
Due 2025-06-26
Exploit
No known exploits
Affected products
3
Google ChromeChromiumMicrosoft Edge Chromium
Timeline
PublishedJun 3
KEV addedJun 5
Latest updateJun 10
KEV dueJun 26
CISA Required Action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Description

Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/chrome137.0.7151.68 — 137.0.7151.68
▶NVDgoogle/chrome< 137.0.7151.68
▶NVDmicrosoft/edge_chromium< 137.0.3296.62
▶Debianchromium/chromium< 137.0.7151.68-1~deb12u1+2

🔴Vulnerability Details

4
OSV
CVE-2025-5419: Out of bounds read and write in V8 in Google Chrome prior to 137↗2025-06-03
▶
GHSA
GHSA-x828-wp24-7h9m: Out of bounds read and write in V8 in Google Chrome prior to 137↗2025-06-03
▶
CVEList
CVE-2025-5419: Out of bounds read and write in V8 in Google Chrome prior to 137↗2025-06-02
▶
VulnCheck
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability↗2025
▶

📋Vendor Advisories

4
Microsoft
Chromium: CVE-2025-5419 Out of bounds read and write in V8↗2025-06-10
▶
Chrome
Long Term Support Channel Update for ChromeOS: CVE-2025-5419↗2025-06-06
▶
CISA
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability↗2025-06-05
▶
Debian
CVE-2025-5419: chromium - Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allow...↗2025
▶
CVE-2025-5419 — Out-of-bounds Read in Google Chrome | cvebase