CVE-2025-12441: Google Chrome V8 RCE Vulnerability

CVE-2025-12441 Overview

CVE-2025-12441 is an out-of-bounds read vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 142.0.7444.59. A remote attacker can trigger the flaw by convincing a user to visit a crafted HTML page, causing the browser to read memory outside the intended buffer boundaries. Google's Chromium team assigned this issue a medium severity rating. The vulnerability affects Chrome across Windows, macOS, and Linux platforms. Successful exploitation allows an attacker to read process memory, which may expose sensitive data such as pointers, tokens, or fragments of adjacent objects useful for chaining with additional exploits.

Critical Impact
Remote attackers can read out-of-bounds memory in the V8 engine via a crafted HTML page, potentially disclosing sensitive process memory to attacker-controlled JavaScript.

Affected Products

Google Chrome versions prior to 142.0.7444.59
Chrome on Microsoft Windows, Apple macOS, and Linux distributions
Chromium-based browsers that embed vulnerable V8 builds

Discovery Timeline

2025-11-10 - CVE-2025-12441 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12441

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that powers Chrome. V8 uses aggressive just-in-time compilation and inline caching to optimize script execution. When bounds checks are missing or incorrectly generated for a specific code path, the engine may access memory outside an allocated buffer during read operations. This class of bug is tracked under [CWE-125: Out-of-Bounds Read].

Exploitation requires user interaction, as the victim must load a malicious HTML page. The attack complexity is low and no authentication is required. The impact is limited to confidentiality — an attacker can disclose in-process memory but cannot directly modify data or crash the renderer with reliability. Read primitives of this type are commonly combined with type confusion or write vulnerabilities to build reliable renderer exploit chains.

Root Cause

The root cause is an out-of-bounds read within V8. Specific details are restricted in the Chromium Issue Tracker Entry until a majority of users have received the fix, which is standard Chrome disclosure practice.

Attack Vector

An attacker hosts or injects malicious JavaScript inside an HTML page. When a user visits the page, the crafted script triggers the vulnerable V8 code path. The engine returns data from memory adjacent to the intended object, which the attacker's script can read and exfiltrate. Delivery vectors include phishing links, malvertising, and compromised third-party content on legitimate sites.

No verified public exploit code is available for CVE-2025-12441. The vulnerability mechanism is described in prose because the Chromium project restricts detailed technical disclosures during the patch rollout window. Refer to the Google Chrome Desktop Update for the official advisory.

Detection Methods for CVE-2025-12441

Indicators of Compromise

Chrome browser processes running versions earlier than 142.0.7444.59 in enterprise inventories
Renderer processes crashing or exhibiting anomalous memory access patterns while loading untrusted pages
Outbound connections from browser sessions to newly registered or low-reputation domains hosting heavy JavaScript payloads

Detection Strategies

Query endpoint inventory data for installed Chrome versions and flag any host below 142.0.7444.59
Monitor for browser child process anomalies, including unexpected renderer crashes correlated with specific URLs
Correlate web proxy logs with browser telemetry to identify users navigating to suspicious HTML pages that trigger repeated renderer exceptions

Monitoring Recommendations

Enable centralized Chrome enterprise reporting to track version compliance across the fleet
Ingest browser and proxy logs into a SIEM to hunt for exploit delivery patterns
Alert on WebAssembly or JavaScript-heavy pages loaded from uncategorized domains, especially when followed by renderer instability

How to Mitigate CVE-2025-12441

Immediate Actions Required

Update Google Chrome to version 142.0.7444.59 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after the update so the patched V8 engine is loaded into all processes
Audit Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply their corresponding V8 patch releases

Patch Information

Google addressed CVE-2025-12441 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Administrators should deploy 142.0.7444.59 or later through managed update channels. The fix is included in subsequent Chrome releases as well.

Workarounds

Restrict browsing to trusted domains through enterprise web filtering until patches are deployed
Disable JavaScript for untrusted origins using Chrome enterprise policy DefaultJavaScriptSetting
Enforce Chrome's Site Isolation and Enhanced Safe Browsing to reduce the impact of renderer-level memory disclosure

bash

# Configuration example: enforce minimum Chrome version via enterprise policy (Windows registry)
reg add "HKLM\Software\Policies\Google\Chrome" /v TargetVersionPrefix /t REG_SZ /d "142.0.7444.59" /f

# macOS: verify installed Chrome version
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Linux: update Chrome via package manager
sudo apt update && sudo apt install --only-upgrade google-chrome-stable