CVE-2025-12437: Google Chrome Use After Free Vulnerability

CVE-2025-12437 Overview

CVE-2025-12437 is a use-after-free vulnerability in the PageInfo component of Google Chrome versions prior to 142.0.7444.59. A remote attacker can exploit heap corruption by serving a crafted HTML page and convincing the user to perform specific UI gestures. Successful exploitation may allow arbitrary code execution within the browser process. The flaw is tracked under CWE-416: Use After Free and was addressed in the Chrome Stable channel update released on October 28, 2025.

Critical Impact

Remote attackers can trigger heap corruption in Chrome's PageInfo component through crafted web content combined with user interaction, potentially leading to arbitrary code execution.

Affected Products

• Google Chrome versions prior to 142.0.7444.59
• Chrome on Microsoft Windows
• Chrome on Apple macOS
• Chrome on Linux

Discovery Timeline

• 2025-11-10 - CVE-2025-12437 published to NVD
• 2025-11-13 - Last updated in NVD database

Technical Details for CVE-2025-12437

Vulnerability Analysis

The vulnerability resides in Chrome's PageInfo subsystem, which renders the security and permissions UI displayed when a user clicks the lock or site information icon in the address bar. A use-after-free condition occurs when the PageInfo object frees a heap-allocated structure while another code path retains a dangling reference. Subsequent dereference of that reference reads or writes freed memory, producing heap corruption.

Attackers leverage this corruption to overwrite object vtables or function pointers within Chrome's renderer or browser process heap. Combined with information leaks or heap grooming, the primitive can be promoted to arbitrary code execution inside the sandboxed renderer. Chromium classified the issue as Medium severity internally; the NVD analysis assigns a higher score reflecting confidentiality, integrity, and availability impact.

Root Cause

The defect stems from improper object lifetime management in PageInfo. UI state transitions triggered by specific gestures release backing objects without invalidating outstanding pointers held by event handlers or asynchronous callbacks. When those handlers fire after deallocation, they operate on freed memory.

Attack Vector

Exploitation requires a victim to visit attacker-controlled HTML content and perform UI gestures on the PageInfo dialog, such as expanding permission lists or interacting with site controls. The user interaction requirement and high attack complexity reflect the precise timing and gesture sequencing needed to win the race that produces the dangling reference. No authentication is required. See the Chromium Issue Tracker entry for vendor-tracked details.

Detection Methods for CVE-2025-12437

Indicators of Compromise

• Chrome browser processes terminating with access violation or segmentation fault errors after visiting untrusted sites
• Unexpected child process spawns from chrome.exe following navigation to attacker-controlled domains
• Crash dumps referencing PageInfo symbols on the call stack

Detection Strategies

• Inventory Chrome installations across endpoints and flag versions below 142.0.7444.59 as vulnerable
• Inspect web proxy and DNS logs for connections to newly registered or low-reputation domains hosting HTML payloads targeting browser bugs
• Correlate browser crash telemetry with subsequent process injection or unusual outbound network activity

Monitoring Recommendations

• Forward Chrome crash reports and Windows Error Reporting events to a centralized SIEM for analysis
• Monitor for anomalous renderer-to-browser process IPC patterns indicative of sandbox escape attempts
• Track endpoint EDR alerts for memory tampering or shellcode behaviors originating from browser processes

How to Mitigate CVE-2025-12437

Immediate Actions Required

• Update Google Chrome to version 142.0.7444.59 or later on all Windows, macOS, and Linux endpoints
• Restart Chrome after the update applies to ensure the patched binaries load
• Validate Chrome auto-update policies are enabled and not blocked by group policy or network restrictions

Patch Information

Google released the fix in the Stable channel update for desktop on October 28, 2025. Refer to the Google Chrome Stable Update advisory for full release notes. Chromium-derived browsers including Microsoft Edge, Brave, and Opera should be updated to versions incorporating the same upstream fix.

Workarounds

• Restrict browsing to trusted domains using web filtering or DNS-layer controls until patching completes
• Train users to avoid interacting with unsolicited site information dialogs on untrusted pages
• Enforce site isolation and the strictest available Chrome enterprise policies to limit renderer compromise impact

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Windows: query installed version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv