Actively exploited in the wild
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google - Chromium V8 · Listed in the CISA KEV since 2025-06-05. This indicates confirmed attacks in production environments.
Required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
CVE-2025-5419
HighCVSS 8.8KEVSummary
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
Risk Assessment
An attacker could exploit this vulnerability to execute code in the browser or cause a crash, potentially leading to session hijacking or data theft.
Recommendation
Update Chrome to version 137.0.7151.68 or later, which includes the fix.
Other vulnerabilities in V8
See all- CVE-2026-14405Critical
In Google Chrome prior to version 150.0.7871.46, an uninitialized use vulnerability exists in the V8 engine. A remote attacker can exploit a crafted HTML page to execute arbitrary code within a sandbox.
- CVE-2025-13223HighActively exploited
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 142.0.7444.175 allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2025-10585CriticalActively exploited
A type confusion vulnerability in the V8 engine in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-15776High
Inappropriate implementation in V8 in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)
- CVE-2026-15775Medium
An inappropriate implementation in the V8 JavaScript engine in Google Chrome prior to 150.0.7871.125 allowed a remote attacker to bypass the same-origin policy via a crafted HTML page. The issue is rated as High severity by the Chromium security team.
- CVE-2026-15770Medium
An uninitialized use vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.125 allows a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page.
- CVE-2026-14432High
A use-after-free vulnerability was found in the V8 engine of Google Chrome prior to version 150.0.7871.46. A remote attacker can exploit a crafted HTML page to execute arbitrary code within the sandbox environment.
- CVE-2026-14431High
A type confusion vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. The issue is rated as high severity.
- CVE-2026-14430High
An integer overflow in the V8 JavaScript engine in Google Chrome prior to version 150.0.7871.46 allows a remote attacker to execute arbitrary code within the sandbox by crafting a malicious HTML page.
- CVE-2026-14426High
A Use-After-Free vulnerability in the V8 engine of Google Chrome prior to version 150.0.7871.46 allows a remote attacker, after convincing a user to perform specific UI gestures, to execute arbitrary code inside a sandbox via a crafted HTML page.
Original NVD description (English source)
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)