Actively exploited in the wild
Google Chromium V8 Type Confusion Vulnerability
Google - Chromium V8 · Listed in the CISA KEV since 2025-11-19. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-13223
HighCVSS 8.8KEVExploitation Probability (EPSS)
Very high risk91th percentile - higher than 91% of all known CVEs
Summary
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 142.0.7444.175 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
Risk Assessment
An attacker can remotely trigger heap corruption, potentially leading to arbitrary code execution within the browser context and ultimately compromising the victim's system.
Recommendation
Immediately update Google Chrome to version 142.0.7444.175 or later. Users of other Chromium-based browsers should also apply the relevant updates.
Original NVD description (English source)
Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)