Chrome V8 CVE-2025-13223: Exploited Type Confusion Zero-Day
This was a live zero-day in November 2025, but Chrome and Edge fixed it within a day and have auto-updated for eleven months since; the remaining work is finding browsers and embedded Chromium builds that never took the update.
Must act: Admins of fleets where Chrome or Edge updates are pinned, deferred or broken, owners of kiosk and VDI images, and teams shipping or running Electron apps built before mid-November 2025.
Can relax: Anyone whose Chrome is at 142.0.7444.175 or later or Edge at 142.0.3595.90 or later, which covers every auto-updating install that has relaunched since late November 2025.
- Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm the version is past the fixed build; current Chrome is 156.
- In managed fleets, report browser versions and flag anything below Chrome 142.0.7444.175 or Edge 142.0.3595.90.
- Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and set relaunch notifications so updates take effect.