Chrome V8 CVE-2025-13223: Exploited Type Confusion Zero-Day

What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm the version is past the fixed build; current Chrome is 156.
2. In managed fleets, report browser versions and flag anything below Chrome 142.0.7444.175 or Edge 142.0.3595.90.
3. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and set relaunch notifications so updates take effect.
4. Rebuild kiosk, VDI and golden images that bake in a browser so they ship a current version.
5. Ask vendors of Electron apps for builds on Electron 37.10.0, 38.7.0, 39.2.3 or later, and retire apps that are no longer maintained.

How to check if you are affected or compromised

• Query endpoint inventory for chrome.exe, msedge.exe or Chromium versions below the fixed builds at any point since mid-November 2025, and list the users of those machines.
• Google has published no indicators for this exploit; for high-risk users who ran unpatched builds in November 2025, review EDR for browser processes spawning unexpected executables and for new persistence around that time.

What happened#

On November 17, 2025, Google released Chrome 142.0.7444.175/.176 for Windows, 142.0.7444.176 for Mac and 142.0.7444.175 for Linux, with two V8 fixes. The first, CVE-2025-13223, is a type confusion in V8, Chrome's JavaScript and WebAssembly engine. Google's Threat Analysis Group (TAG) reported it on November 12. The release notes state: "Google is aware that an exploit for CVE-2025-13223 exists in the wild." The CVE record says a crafted HTML page could "potentially exploit heap corruption." The second fix, CVE-2025-13224, is another V8 type confusion, reported by Google Big Sleep in October. Google did not say it was exploited, and it is not in KEV.

The CNA did not score the bug. CISA's ADP entry on NVD rates it CVSS 3.1 8.8 (CWE-843). CISA added it to KEV on November 19, 2025. The Register named Clément Lecigne of TAG as the finder and counted this as Chrome's seventh zero-day of 2025. Google has not said who used the exploit or against whom.

Who is affected#

Chrome before 142.0.7444.175 on every desktop platform, plus anything else that embeds an unpatched V8. The verified fixed builds are:

• Microsoft Edge 142.0.3595.90, released November 18, 2025, according to Microsoft's Edge security notes.
• Electron 37.10.0 and 38.7.0, which backported the fix on November 14.
• Electron 39.2.3, which moved to Chromium 142.0.7444.175 on November 19.

Google did not post a separate Android note for this fix. Chrome for Android updates through Google Play and has been on 156 since October 20, 2026. Other Chromium-based browsers ship V8 fixes on their own schedules.

Do you really need to act?#

For most users, no. Chrome and Edge auto-update, and Chrome Stable is now 156, fourteen milestones past the fix. Lingering exposure looks like this:

• Machines where update policies pin or defer the browser.
• Kiosks and VDI images that bake in a 2025 build.
• Users who never relaunch.
• Electron apps built on Chromium older than mid-November 2025.

Each of these still runs a V8 that attackers have already exploited. Find them, but there is no reason to treat this as an emergency today.

What to do now#

1. Check versions with google-chrome --version, or on Windows with (Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion. For Edge, use edge://settings/help.
2. In your endpoint inventory, flag anything below Chrome 142.0.7444.175 or Edge 142.0.3595.90.
3. Open chrome://policy on managed machines and remove version pins or indefinite update deferrals. Enable RelaunchNotification so updates take effect.
4. Rebuild kiosk, VDI and golden images that bake in a browser.
5. On macOS, read an Electron app's version with defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion. Upgrade or retire apps below 37.10.0, 38.7.0 or 39.2.3 on their line.

How to tell if you were hit#

Google has published no indicators of compromise for this exploit. Start from inventory: which machines ran Chrome or Edge below the fixed builds after mid-November 2025, and who used them? For journalists, activists and executives in that group, review EDR telemetry from that period. Look for browser processes spawning unexpected executables, and for new services, scheduled tasks or launch agents.

Timeline#

• Nov 12, 2025 — Google TAG reports the bug to Chrome.
• Nov 14, 2025 — Electron 37.10.0 and 38.7.0 backport the fix.
• Nov 17, 2025 — Chrome 142.0.7444.175/.176 ships, Google confirms an in-the-wild exploit, and the CVE is published.
• Nov 18, 2025 — Microsoft ships Edge 142.0.3595.90.
• Nov 19, 2025 — CISA adds CVE-2025-13223 to KEV, with a federal deadline of December 10.

Vulnerability records

• CVE-2025-13223 · KEV 2025-11-19 · Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.

Sources

Original sources first: vendor and project advisories, CVE and government records, the discoverers’ write-ups. Every claim above links to one of these. See how the Security Desk works.

Original and primary sources

1. Google Chrome Releases — Stable Channel Update for Desktop (Nov 17, 2025) chromereleases.googleblog.com
2. CVE record — CVE-2025-13223 cve.org
3. NVD — CVE-2025-13223 nvd.nist.gov
4. CISA — Known Exploited Vulnerabilities: CVE-2025-13223 cisa.gov
5. Microsoft — Release notes for Microsoft Edge Security Updates learn.microsoft.com
6. Electron — v38.7.0 release notes github.com
7. Electron — v39.2.3 release notes github.com
8. Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026) chromereleases.googleblog.com
9. Google Chrome Releases — Chrome for Android Update (Oct 20, 2026) chromereleases.googleblog.com

Coverage and analysis

1. The Register — Google Chrome bug exploited as an 0-day theregister.com