---
title: "Chrome V8 CVE-2025-13223: Exploited Type Confusion Zero-Day"
url: https://erroneo.us/security/briefs/chrome-v8-cve-2025-13223-type-confusion-zero-day/
description: "V8 type confusion found by Google TAG, exploited and fixed in Chrome 142.0.7444.175 on Nov 17, 2025. Auto-updated browsers are safe; check pinned fleets."
type: security-brief
section: "Security Digest"
date_published: 2025-11-17
date_modified: 2026-10-23
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Check exposure"
cves: ["CVE-2025-13223"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome V8 CVE-2025-13223: Exploited Type Confusion Zero-Day

**Verdict: Check exposure.** This was a live zero-day in November 2025, but Chrome and Edge fixed it within a day and have auto-updated for eleven months since; the remaining work is finding browsers and embedded Chromium builds that never took the update.

- **Who must act:** Admins of fleets where Chrome or Edge updates are pinned, deferred or broken, owners of kiosk and VDI images, and teams shipping or running Electron apps built before mid-November 2025.
- **Who can relax:** Anyone whose Chrome is at 142.0.7444.175 or later or Edge at 142.0.3595.90 or later, which covers every auto-updating install that has relaunched since late November 2025.
- **Affected:** Google Chrome before 142.0.7444.175 (Windows, Linux) and before 142.0.7444.176 (Mac); Microsoft Edge before 142.0.3595.90; Electron releases without the backport (before 37.10.0, 38.7.0 or 39.2.3 on those lines); Other Chromium-based browsers and embedded Chromium until their vendors ship the V8 fix
- **Fixed:** Chrome 142.0.7444.175/.176 Windows, 142.0.7444.176 Mac, 142.0.7444.175 Linux (Nov 17, 2025); Microsoft Edge 142.0.3595.90 (Nov 18, 2025); Electron 37.10.0 and 38.7.0 (Nov 14, 2025) and 39.2.3 (Nov 19, 2025)
- **CVEs:** CVE-2025-13223
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Open chrome://settings/help (or edge://settings/help), relaunch if an update is pending, and confirm the version is past the fixed build; current Chrome is 156.
2. In managed fleets, report browser versions and flag anything below Chrome 142.0.7444.175 or Edge 142.0.3595.90.
3. Remove policies that pin Chrome or Edge to an old version or defer updates indefinitely, and set relaunch notifications so updates take effect.
4. Rebuild kiosk, VDI and golden images that bake in a browser so they ship a current version.
5. Ask vendors of Electron apps for builds on Electron 37.10.0, 38.7.0, 39.2.3 or later, and retire apps that are no longer maintained.

### How to check if you are affected

- Query endpoint inventory for chrome.exe, msedge.exe or Chromium versions below the fixed builds at any point since mid-November 2025, and list the users of those machines.
- Google has published no indicators for this exploit; for high-risk users who ran unpatched builds in November 2025, review EDR for browser processes spawning unexpected executables and for new persistence around that time.

## What happened

On November 17, 2025, Google released Chrome 142.0.7444.175/.176 for Windows, 142.0.7444.176 for Mac and 142.0.7444.175 for Linux, with two V8 fixes. The first, [CVE-2025-13223](https://www.cve.org/CVERecord?id=CVE-2025-13223), is a type confusion in V8, Chrome's JavaScript and WebAssembly engine. Google's Threat Analysis Group (TAG) reported it on November 12. The [release notes](https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html) state: "Google is aware that an exploit for CVE-2025-13223 exists in the wild." The CVE record says a crafted HTML page could "potentially exploit heap corruption." The second fix, CVE-2025-13224, is another V8 type confusion, reported by Google Big Sleep in October. Google did not say it was exploited, and it is not in KEV.

The CNA did not score the bug. CISA's ADP entry on [NVD](https://nvd.nist.gov/vuln/detail/CVE-2025-13223) rates it CVSS 3.1 8.8 (CWE-843). CISA added it to [KEV](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-13223) on November 19, 2025. [The Register](https://www.theregister.com/2025/11/18/google_chrome_seventh_0_day/) named Clément Lecigne of TAG as the finder and counted this as Chrome's seventh zero-day of 2025. Google has not said who used the exploit or against whom.

## Who is affected

Chrome before 142.0.7444.175 on every desktop platform, plus anything else that embeds an unpatched V8. The verified fixed builds are:

- Microsoft Edge 142.0.3595.90, released November 18, 2025, according to Microsoft's [Edge security notes](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security).
- Electron 37.10.0 and [38.7.0](https://github.com/electron/electron/releases/tag/v38.7.0), which backported the fix on November 14.
- Electron [39.2.3](https://github.com/electron/electron/releases/tag/v39.2.3), which moved to Chromium 142.0.7444.175 on November 19.

Google did not post a separate Android note for this fix. Chrome for Android updates through Google Play and has been on [156](https://chromereleases.googleblog.com/2026/10/chrome-for-android-update_095004068.html) since October 20, 2026. Other Chromium-based browsers ship V8 fixes on their own schedules.

## Do you really need to act?

For most users, no. Chrome and Edge auto-update, and Chrome Stable is now [156](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html), fourteen milestones past the fix. Lingering exposure looks like this:

- Machines where update policies pin or defer the browser.
- Kiosks and VDI images that bake in a 2025 build.
- Users who never relaunch.
- Electron apps built on Chromium older than mid-November 2025.

Each of these still runs a V8 that attackers have already exploited. Find them, but there is no reason to treat this as an emergency today.

## What to do now

1. Check versions with `google-chrome --version`, or on Windows with `(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion`. For Edge, use `edge://settings/help`.
2. In your endpoint inventory, flag anything below Chrome 142.0.7444.175 or Edge 142.0.3595.90.
3. Open `chrome://policy` on managed machines and remove version pins or indefinite update deferrals. Enable `RelaunchNotification` so updates take effect.
4. Rebuild kiosk, VDI and golden images that bake in a browser.
5. On macOS, read an Electron app's version with `defaults read "/Applications/App.app/Contents/Frameworks/Electron Framework.framework/Resources/Info.plist" CFBundleVersion`. Upgrade or retire apps below 37.10.0, 38.7.0 or 39.2.3 on their line.

## How to tell if you were hit

Google has published no indicators of compromise for this exploit. Start from inventory: which machines ran Chrome or Edge below the fixed builds after mid-November 2025, and who used them? For journalists, activists and executives in that group, review EDR telemetry from that period. Look for browser processes spawning unexpected executables, and for new services, scheduled tasks or launch agents.

## Timeline

- Nov 12, 2025 — Google TAG reports the bug to Chrome.
- Nov 14, 2025 — Electron 37.10.0 and 38.7.0 backport the fix.
- Nov 17, 2025 — Chrome 142.0.7444.175/.176 ships, Google confirms an in-the-wild exploit, and the CVE is published.
- Nov 18, 2025 — Microsoft ships Edge 142.0.3595.90.
- Nov 19, 2025 — CISA adds CVE-2025-13223 to KEV, with a federal deadline of December 10.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Nov 17, 2025)](https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html)
2. [CVE record — CVE-2025-13223](https://www.cve.org/CVERecord?id=CVE-2025-13223)
3. [NVD — CVE-2025-13223](https://nvd.nist.gov/vuln/detail/CVE-2025-13223)
4. [CISA — Known Exploited Vulnerabilities: CVE-2025-13223](https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-13223)
5. [Microsoft — Release notes for Microsoft Edge Security Updates](https://learn.microsoft.com/en-us/deployedge/microsoft-edge-relnotes-security)
6. [Electron — v38.7.0 release notes](https://github.com/electron/electron/releases/tag/v38.7.0)
7. [Electron — v39.2.3 release notes](https://github.com/electron/electron/releases/tag/v39.2.3)
8. [Google Chrome Releases — Chrome 156 promoted to Stable (Oct 20, 2026)](https://chromereleases.googleblog.com/2026/10/stable-channel-update-for-desktop_02018666648.html)
9. [Google Chrome Releases — Chrome for Android Update (Oct 20, 2026)](https://chromereleases.googleblog.com/2026/10/chrome-for-android-update_095004068.html)
10. [The Register — Google Chrome bug exploited as an 0-day](https://www.theregister.com/2025/11/18/google_chrome_seventh_0_day/)

---
Source page: https://erroneo.us/security/briefs/chrome-v8-cve-2025-13223-type-confusion-zero-day/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt