CVE-2025-12433: Google Chrome V8 RCE Vulnerability

CVE-2025-12433 Overview

CVE-2025-12433 affects the V8 JavaScript engine in Google Chrome versions prior to 142.0.7444.59. The flaw stems from an inappropriate implementation in V8 that permits out-of-bounds memory access when a user visits a crafted HTML page. A remote attacker can trigger the condition without authentication, though user interaction is required. Chromium engineers classified the internal severity as High, while the NVD assigned a medium CVSS rating reflecting the limited confidentiality impact and lack of integrity or availability effects. Google addressed the issue in the Stable channel update released on October 28, 2025.

Critical Impact
Remote attackers can trigger out-of-bounds memory access in V8 through a crafted HTML page, potentially exposing process memory contents.

Affected Products

Google Chrome prior to 142.0.7444.59 on Microsoft Windows
Google Chrome prior to 142.0.7444.59 on Apple macOS
Google Chrome prior to 142.0.7444.59 on Linux

Discovery Timeline

2025-11-10 - CVE-2025-12433 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12433

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome and Chromium-based browsers. V8 compiles JavaScript to native machine code through its TurboFan and Maglev optimizing compilers, applying assumptions about object shapes and array bounds to eliminate runtime checks. An inappropriate implementation in this code path allows a crafted HTML page to induce out-of-bounds memory access during script execution.

Out-of-bounds access in V8 typically permits an attacker to read adjacent heap memory. This can leak pointer values, object metadata, or sensitive data resident in the renderer process. Chromium sandboxing constrains the immediate blast radius, but memory disclosure primitives are frequently chained with additional bugs to defeat address space layout randomization (ASLR) and progress toward renderer compromise.

The National Vulnerability Database does not enumerate a specific CWE for this issue, listing it as NVD-CWE-noinfo. The underlying weakness aligns with Out-of-Bounds Read behavior in a JIT-compiled runtime.

Root Cause

The root cause is an inappropriate implementation within V8 that fails to correctly enforce memory bounds during a specific JavaScript operation. Chromium's public issue tracker entry 449760249 is restricted, which is standard practice while patches propagate. Vulnerabilities of this class often originate from missing bounds checks in optimized code paths, incorrect type feedback consumed by the compiler, or flawed inlining assumptions.

Attack Vector

Exploitation requires a victim to load a malicious HTML page in a vulnerable Chrome build. The attacker hosts JavaScript that triggers the vulnerable V8 code path, forcing an out-of-bounds read. Delivery mechanisms include phishing links, compromised websites, and malicious advertisements served through legitimate ad networks. No credentials or prior access are required.

See the Chromium Issue Tracker Entry for the internal bug reference and the Google Chrome Update Announcement for the release notes covering this fix.

Detection Methods for CVE-2025-12433

Indicators of Compromise

Chrome browser processes running versions earlier than 142.0.7444.59 after the patch release window.
Renderer process crashes containing V8 stack frames such as v8::internal:: symbols after visiting untrusted pages.
Outbound connections from browser processes to newly registered or low-reputation domains hosting heavily obfuscated JavaScript.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any host running a build below 142.0.7444.59.
Correlate browser crash telemetry with URL history to identify potential exploitation attempts against V8.
Inspect proxy or DNS logs for repeated retrieval of large or obfuscated JavaScript payloads immediately preceding renderer instability.

Monitoring Recommendations

Enable Chrome enterprise reporting to centralize version, extension, and crash data.
Monitor renderer child processes for anomalous child process creation, file writes, or credential store access.
Alert on Chrome updates being disabled or blocked at the endpoint or network layer.

How to Mitigate CVE-2025-12433

Immediate Actions Required

Update Google Chrome to version 142.0.7444.59 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update installs to ensure the patched V8 binary is loaded.
Update Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi once their respective vendors ship the corresponding V8 fix.

Patch Information

Google released the fix in the Stable channel update for desktop on October 28, 2025. Administrators should consult the Google Chrome Update Announcement and deploy version 142.0.7444.59 or newer. Chrome's built-in updater applies the patch automatically on next relaunch when enterprise policy permits.

Workarounds

Enforce automatic Chrome updates via the ChromeCleanupEnabled and DefaultBrowserSettingEnabled group policies or the equivalent MDM configuration on macOS.
Restrict browsing to trusted sites through URL allowlists until patch deployment completes across the fleet.
Disable JavaScript on high-risk endpoints using the DefaultJavaScriptSetting policy where operationally feasible.

bash

# Verify installed Chrome version on Windows
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Verify installed Chrome version on macOS
defaults read /Applications/Google\ Chrome.app/Contents/Info CFBundleShortVersionString

# Verify installed Chrome version on Linux
google-chrome --version