CVE-2025-13224

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to...

8.8 HighPublic exploitFix available

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: Required

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

0.48%Up 0.4 points since Nov 18, 2025

What each source reports

CVE List Score used 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2025-13224
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-843
Updated: 2026-11-02

EUVDEUVD-2025-197892 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: EUVD-2025-197892
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w5fc-g575-v9qj 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to...

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: GHSA-w5fc-g575-v9qj
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-843
Updated: 2026-11-02

NVD 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2025-13224
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Weakness: CWE-843
Updated: 2026-11-02

OSVALPINE-CVE-2025-13224 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: ALPINE-CVE-2025-13224
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-03

OSV 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: CVE-2025-13224
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

Show 5 moreShow less

OSVDEBIAN-CVE-2025-13224 8.8

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: DEBIAN-CVE-2025-13224
CVSS 3.1: 8.8 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVAZL-70553 No score

CVE-2025-13224 affecting package nodejs18 18.20.3-11

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: AZL-70553
Updated: 2026-11-02

OSVAZL-70604 No score

CVE-2025-13224 affecting package nodejs for versions less than 24.14.1-3

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Record: AZL-70604
Updated: 2026-11-02

OSVopenSUSE-SU-2025:15745-1 No score

chromedriver-142.0.7444.175-1.1 on GA media

These are all security issues fixed in the chromedriver-142.0.7444.175-1.1 package on the GA media of openSUSE Tumbleweed.

Record: openSUSE-SU-2025:15745-1
Updated: 2026-11-02

OSVopenSUSE-SU-2025:20076-1 No score

Security update for chromium

This update for chromium fixes the following issues:

Changes in chromium:

Chromium 142.0.7444.175 (boo#1253698):

CVE-2025-13223: Type Confusion in V8
CVE-2025-13224: Type Confusion in V8

Chromium 142.0.7444.162 (boo#1253267):

CVE-2025-13042: Inappropriate implementation in V8

Chromium 142.0.7444.134 (boo#1253089):

CVE-2025-12725: Out of bounds write in WebGPU
CVE-2025-12726: Inappropriate implementation in Views
CVE-2025-12727: Inappropriate implementation in V8
CVE-2025-12728: Inappropriate implementation in Omnibox
CVE-2025-12729: Inappropriate implementation in Omnibox

Chromium 142.0.7444.59, the stable channel promotion of 142.

Security fixes (boo#1252881):

CVE-2025-12428: Type Confusion in V8
CVE-2025-12429: Inappropriate implementation in V8
CVE-2025-12430: Object lifecycle issue in Media
CVE-2025-12431: Inappropriate implementation in Extensions
CVE-2025-12432: Race in V8
CVE-2025-12433: Inappropriate implementation in V8
CVE-2025-12434: Race in Storage
CVE-2025-12435: Incorrect security UI in Omnibox
CVE-2025-12436: Policy bypass in Extensions
CVE-2025-12437: Use after free in PageInfo
CVE-2025-12438: Use after free in Ozone
CVE-2025-12439: Inappropriate implementation in App-Bound Encryption
CVE-2025-12440: Inappropriate implementation in Autofill
CVE-2025-12441: Out of bounds read in V8
CVE-2025-12443: Out of bounds read in WebXR
CVE-2025-12444: Incorrect security UI in Fullscreen UI
CVE-2025-12445: Policy bypass in Extensions
CVE-2025-12446: Incorrect security UI in SplitView
CVE-2025-12447: Incorrect security UI in Omnibox

Record: openSUSE-SU-2025:20076-1
Updated: 2026-11-02

Affected products

google chrome

Affected packages

Affected packages
Package	Affected	Fixed
`qt6-qtwebengine` Alpine:v3.23	before 6.10.1-r1	6.10.1-r1
`qt6-qtwebengine` Alpine:v3.24	before 6.10.1-r2	6.10.1-r2
`nodejs18` Azure Linux:2	through 18.20.3-11	None known
`nodejs` Azure Linux:3	before 24.14.1-3	24.14.1-3
`chromium` Debian:12	before 142.0.7444.175-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less 114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1	142.0.7444.175-1~deb12u1
`chromium` Debian:13	before 142.0.7444.175-1~deb13u1, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 42 moreShow less 139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1~deb12u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1	142.0.7444.175-1~deb13u1
`chromium` Debian:14	before 142.0.7444.175-1, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 43 moreShow less 139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1~deb12u1142.0.7444.175-1~deb13u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1	142.0.7444.175-1
`chromium` Debian:12 From an advisory covering 2 CVEs	before 142.0.7444.175-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less 114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1	142.0.7444.175-1~deb12u1
`chromium` Debian:13 From an advisory covering 2 CVEs	before 142.0.7444.175-1~deb13u1, plus listed versions 138.0.7204.183-1139.0.7258.127-1139.0.7258.127-1~deb12u1139.0.7258.127-1~deb13u1139.0.7258.127-2 Show 42 moreShow less 139.0.7258.138-1139.0.7258.138-1~deb12u1139.0.7258.138-1~deb13u1139.0.7258.154-1139.0.7258.154-1~deb12u1139.0.7258.154-1~deb13u1139.0.7258.66-1139.0.7258.66-1~deb12u1140.0.7339.127-1140.0.7339.127-1~deb12u1140.0.7339.127-1~deb13u1140.0.7339.185-1140.0.7339.185-1~deb12u1140.0.7339.185-1~deb13u1140.0.7339.207-1140.0.7339.207-1~deb12u1140.0.7339.207-1~deb13u1140.0.7339.80-1140.0.7339.80-1~deb12u1140.0.7339.80-1~deb13u1141.0.7390.107-1141.0.7390.107-1~deb12u1141.0.7390.107-1~deb13u1141.0.7390.122-1141.0.7390.122-1~deb12u1141.0.7390.122-1~deb13u1141.0.7390.54-1141.0.7390.54-1~deb12u1141.0.7390.54-1~deb13u1141.0.7390.65-1141.0.7390.65-1~deb12u1141.0.7390.65-1~deb13u1142.0.7444.134-1142.0.7444.134-1~deb12u1142.0.7444.134-1~deb13u1142.0.7444.162-1142.0.7444.162-1~deb12u1142.0.7444.162-1~deb13u1142.0.7444.175-1~deb12u1142.0.7444.59-1142.0.7444.59-1~deb12u1142.0.7444.59-1~deb13u1	142.0.7444.175-1~deb13u1
`chromium` openSUSE:Tumbleweed From an advisory covering 2 CVEs	before 142.0.7444.175-1.1	142.0.7444.175-1.1
`chromium` openSUSE:Leap 16.0 From an advisory covering 28 CVEs	before 142.0.7444.162-bp160.1.1	142.0.7444.162-bp160.1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
PoC in GitHub	jamezx32/CVE-2025-13224	2026-10-14

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected, facts
Nov 3, 2026	affected, aliases, references	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-13224 is a high vulnerability (CVSS 8.8) in Google Chrome, published November 17, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.48%, the 41st percentile. Fixed in qt6-qtwebengine 6.10.1-r1.

References

Show 32 moreShow less

This page doesn't list everything

Left out here: 462 versions. The JSON record has them.