CVE-2025-6191: Google Chrome V8 RCE Vulnerability

CVE-2025-6191 Overview

CVE-2025-6191 is an integer overflow vulnerability in the V8 JavaScript engine used by Google Chrome. This vulnerability affects versions of Google Chrome prior to 137.0.7151.119 and allows a remote attacker to potentially perform out-of-bounds memory access through a crafted HTML page. The vulnerability was assigned a High severity rating by the Chromium security team.

Critical Impact

A remote attacker could exploit this integer overflow in V8 to achieve out-of-bounds memory access, potentially leading to arbitrary code execution, information disclosure, or browser crashes when a victim visits a malicious webpage.

Affected Products

• Google Chrome versions prior to 137.0.7151.119
• All platforms running vulnerable Chrome versions (Windows, macOS, Linux)
• Chromium-based browsers that incorporate the vulnerable V8 engine

Discovery Timeline

• 2025-06-18 - CVE-2025-6191 published to NVD
• 2025-07-03 - Last updated in NVD database

Technical Details for CVE-2025-6191

Vulnerability Analysis

This vulnerability is classified under CWE-190 (Integer Overflow or Wraparound) and CWE-472 (External Control of Assumed-Immutable Web Parameter). The integer overflow occurs within V8, Google Chrome's high-performance JavaScript and WebAssembly engine. When processing specially crafted JavaScript or WebAssembly content, arithmetic operations can exceed the maximum value that an integer variable can hold, causing the value to wrap around. This wraparound can result in incorrect memory allocation sizes or array bounds calculations.

The vulnerability requires user interaction—specifically, the victim must navigate to a malicious webpage hosting the crafted HTML content. Once triggered, the integer overflow can corrupt memory state within the V8 engine's heap, potentially allowing an attacker to read or write memory outside of intended boundaries.

Root Cause

The root cause stems from insufficient validation of arithmetic operations in the V8 JavaScript engine. When certain calculations involving array sizes, buffer lengths, or memory offsets are performed without proper overflow checks, the resulting values can wrap around to small positive values or negative numbers. This leads to undersized memory allocations that are subsequently accessed as if they were larger, enabling out-of-bounds memory operations.

Integer overflow vulnerabilities in JavaScript engines are particularly dangerous because V8 performs just-in-time (JIT) compilation and aggressive optimizations that can amplify the impact of memory corruption bugs.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker must host malicious JavaScript code on a webpage and convince a victim to visit it. The exploitation flow typically involves:

1. Victim navigates to an attacker-controlled or compromised website
2. Malicious JavaScript triggers the integer overflow condition in V8
3. The overflow results in out-of-bounds memory access
4. Attacker leverages memory corruption to achieve code execution or information disclosure

The vulnerability affects the confidentiality, integrity, and availability of the affected system, as successful exploitation could allow attackers to execute arbitrary code within the browser's sandbox, steal sensitive data, or crash the browser.

For technical details on this vulnerability, refer to the Google Chrome Release Update and the Chromium Issue Tracker Entry.

Detection Methods for CVE-2025-6191

Indicators of Compromise

• Unusual Chrome browser crashes or instability when visiting specific websites
• Unexpected memory consumption patterns in Chrome processes
• V8 engine crash dumps indicating heap corruption or out-of-bounds access
• Browser process spawning unusual child processes after visiting unknown websites

Detection Strategies

• Monitor for Chrome version numbers below 137.0.7151.119 across enterprise endpoints
• Deploy endpoint detection rules to identify V8 crash signatures associated with integer overflow exploitation
• Implement browser isolation for untrusted web content to contain potential exploitation attempts
• Analyze network traffic for known malicious domains serving exploit payloads

Monitoring Recommendations

• Enable Chrome crash reporting and monitor for patterns indicating V8 exploitation attempts
• Configure SIEM alerts for multiple browser crashes from the same source across endpoints
• Monitor web proxy logs for suspicious JavaScript-heavy pages from untrusted sources
• Implement behavioral analysis to detect anomalous renderer process activity

How to Mitigate CVE-2025-6191

Immediate Actions Required

• Update Google Chrome to version 137.0.7151.119 or later immediately
• Enable automatic updates for Chrome to ensure timely security patches
• Consider using browser isolation technologies for high-risk browsing activities
• Audit enterprise systems to identify and remediate unpatched Chrome installations

Patch Information

Google has addressed this vulnerability in Chrome version 137.0.7151.119. The fix implements proper bounds checking for arithmetic operations in the V8 engine to prevent integer overflow conditions. Organizations should apply this update across all managed Chrome installations as soon as possible.

Patch details are available in the Google Chrome Stable Channel Update announcement.

Workarounds

• Disable JavaScript execution for untrusted websites using Chrome's site settings (reduces functionality)
• Employ browser isolation solutions to execute untrusted web content in isolated environments
• Use enterprise group policies to restrict access to known malicious or high-risk domains
• Consider temporary use of alternative browsers while awaiting patch deployment

# Check current Chrome version (command line)
google-chrome --version

# Force Chrome update check via command line (Linux)
google-chrome --check-for-update-interval=1

# Enterprise deployment: Use Chrome Browser Cloud Management
# or deploy via SCCM/Intune with version targeting 137.0.7151.119+