CVE-2025-13721: Google Chrome Use-After-Free Vulnerability

CVE-2025-13721 Overview

CVE-2025-13721 is a race condition vulnerability in the V8 JavaScript engine used by Google Chrome versions prior to 143.0.7499.41. The flaw allows a remote attacker to potentially trigger heap corruption by serving a crafted HTML page to a target user. Successful exploitation requires user interaction, such as visiting a malicious or compromised website. Because V8 is the core JavaScript and WebAssembly engine in Chrome and Chromium-based browsers, the vulnerability has broad reach across desktop platforms including Windows, macOS, and Linux. The issue is tracked under [CWE-362] (Concurrent Execution using Shared Resource with Improper Synchronization).

Critical Impact

A remote attacker can leverage a race condition in V8 to corrupt heap memory through a crafted HTML page, potentially leading to arbitrary code execution in the renderer process.

Affected Products

• Google Chrome versions prior to 143.0.7499.41 on Windows
• Google Chrome versions prior to 143.0.7499.41 on macOS
• Google Chrome versions prior to 143.0.7499.41 on Linux

Discovery Timeline

• 2025-12-02 - CVE-2025-13721 published to NVD
• 2025-12-04 - Last updated in NVD database

Technical Details for CVE-2025-13721

Vulnerability Analysis

The vulnerability resides in V8, the open-source JavaScript and WebAssembly engine that powers Chrome. A race condition occurs when two or more execution flows access shared resources without proper synchronization. In V8, such races can leave heap objects in inconsistent states, enabling heap corruption primitives that an attacker can shape into type confusion or use-after-free conditions.

An attacker exploits the flaw by hosting a crafted HTML page containing JavaScript that triggers the race. The renderer process executes the malicious script, and if the race window is won, heap metadata or object pointers become corrupted. From there, an attacker can pivot toward arbitrary read/write primitives inside the renderer sandbox.

Google classifies the Chromium severity as Medium, while NVD assigns a higher CVSS rating due to the potential confidentiality, integrity, and availability impact.

Root Cause

The root cause is improper synchronization of shared state within V8 [CWE-362]. Concurrent operations, often involving background compilation, garbage collection, or worker threads, modify objects without sufficient locking or atomicity guarantees, producing exploitable memory corruption.

Attack Vector

Exploitation is network-based and requires user interaction. The victim must load attacker-controlled content in Chrome. The attack complexity is high because the attacker must reliably win a narrow timing race against V8 internals. See the Chromium Issue Tracker #355120682 for tracking information.

No verified public proof-of-concept code is available for this vulnerability. The vulnerability mechanism is described in prose above; refer to the Google Chrome Desktop Update for vendor details.

Detection Methods for CVE-2025-13721

Indicators of Compromise

• Unexpected Chrome renderer process crashes with heap corruption signatures in crash logs or Windows Error Reporting telemetry.
• Chrome processes spawning unusual child processes or executing shell commands following a browsing session.
• Outbound connections from Chrome to previously unseen domains immediately after page load.

Detection Strategies

• Inventory installed Chrome versions across managed endpoints and flag any instance reporting a version earlier than 143.0.7499.41.
• Monitor renderer crash telemetry for repeated faults originating in v8.dll, libv8.so, or the equivalent module on macOS.
• Correlate web proxy logs with endpoint browsing history to identify users visiting suspicious or newly registered domains delivering heavy JavaScript or WebAssembly payloads.

Monitoring Recommendations

• Enable browser telemetry forwarding to a centralized logging platform and alert on Chrome version drift.
• Track process lineage from chrome.exe and equivalents to detect post-exploitation child processes such as cmd.exe, powershell.exe, or bash.
• Apply network egress monitoring to identify command-and-control traffic following suspected exploitation.

How to Mitigate CVE-2025-13721

Immediate Actions Required

• Update Google Chrome to version 143.0.7499.41 or later on all Windows, macOS, and Linux endpoints.
• Restart Chrome on managed devices to ensure the patched binary is loaded into memory.
• Audit Chromium-based browsers, such as Microsoft Edge, Brave, Opera, and Vivaldi, and apply the corresponding vendor update that incorporates the V8 fix.

Patch Information

Google released the fix in the Chrome Stable channel update referenced in the Google Chrome Desktop Update. Apply version 143.0.7499.41 or later. Enterprise administrators should deploy the update via Chrome Browser Cloud Management, Group Policy, or their endpoint management platform.

Workarounds

• Restrict browsing to trusted sites through enterprise URL filtering until the patch is deployed.
• Disable JavaScript on untrusted origins using the DefaultJavaScriptSetting Chrome enterprise policy where operationally feasible.
• Enforce site isolation and the strictest sandbox settings to reduce the impact of renderer compromise.

# Configuration example: enforce minimum Chrome version via policy on Linux
# /etc/opt/chrome/policies/managed/version_policy.json
{
  "BrowserSwitcherEnabled": false,
  "DefaultJavaScriptSetting": 2,
  "JavaScriptAllowedForUrls": [
    "https://*.corp.example.com",
    "https://*.trusted-partner.com"
  ]
}