CVE-2025-5419
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote...
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2025-5419- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
EUVDEUVD-2025-16695
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
EUVD-2025-16695- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-x828-wp24-7h9m
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote...
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
GHSA-x828-wp24-7h9m- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
CISA KEV No score
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Record
CVE-2025-5419- Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
NVD
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2025-5419- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Weakness
- CWE-125, CWE-787
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-5419
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
ALPINE-CVE-2025-5419- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-03
Show 5 moreShow less
OSV
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
CVE-2025-5419- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2025-5419
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
- Record
DEBIAN-CVE-2025-5419- CVSS 3.1
- 8.8 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2025-0187 No score
Updated chromium-browser-stable packages fix security vulnerabilities
CVE-2025-5063: Use after free in Compositing. CVE-2025-5280: Out of bounds write in V8. CVE-2025-5064: Inappropriate implementation in Background Fetch API. CVE-2025-5065: Inappropriate implementation in FileSystemAccess API. CVE-2025-5066: Inappropriate implementation in Messages. CVE-2025-5281: Inappropriate implementation in BFCache. CVE-2025-5283: Use after free in libvpx. CVE-2025-5067: Inappropriate implementation in Tab Strip. CVE-2025-5419: Out of bounds read and write in V8. CVE-2025-5068: Use after free in Blink. CVE-2025-5958: Use after free in Media. CVE-2025-5959: Type Confusion in V8.
- Record
MGASA-2025-0187- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15210-1 No score
chromedriver-138.0.7204.96-1.1 on GA media
These are all security issues fixed in the chromedriver-138.0.7204.96-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15210-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15249-1 No score
nodejs-electron-35.6.0-1.2 on GA media
These are all security issues fixed in the nodejs-electron-35.6.0-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15249-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-qtwebengineAlpine:v3.22 |
before 6.8.3-r1 | 6.8.3-r1 |
chromiumDebian:12 |
before 137.0.7151.68-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1 |
137.0.7151.68-1~deb12u1 |
chromiumDebian:13 |
before 137.0.7151.68-1 | 137.0.7151.68-1 |
chromiumDebian:14 |
before 137.0.7151.68-1 | 137.0.7151.68-1 |
chromiumDebian:12 From an advisory covering 2 CVEs |
before 137.0.7151.68-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1 |
137.0.7151.68-1~deb12u1 |
chromium-browser-stableMageia:9 From an advisory covering 12 CVEs |
before 136.0.7103.113-2.mga9.tainted | 136.0.7103.113-2.mga9.tainted |
chromiumopenSUSE:Tumbleweed From an advisory covering 18 CVEs |
before 138.0.7204.96-1.1 | 138.0.7204.96-1.1 |
nodejs-electronopenSUSE:Tumbleweed |
before 35.6.0-1.2 | 35.6.0-1.2 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | itsShotgun/chrome_v8_cve_checker | 2025-06-14 |
| PoC in GitHub | riemannj/CVE-2025-5419 | 2025-08-13 |
| PoC in GitHub | mistymntncop/CVE-2025-5419 | 2025-08-25 |
| PoC in GitHub | bjrjk/CVE-2025-5419 | 2026-01-29 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| exploitation | ||
| affected, aliases, exploits, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-5419 is a high vulnerability (CVSS 8.8) in Google Chrome, published June 2, 2025. CISA lists it as known to be exploited, since June 5, 2025. EUVD reports exploitation since June 5, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 7.49%, the 94th percentile. Fixed in qt6-qtwebengine 6.8.3-r1.
References
chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html
issues.chromium.org/issues/420636529
cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-5419
msrc.microsoft.com/update-guide/vulnerability/CVE-2025-5419
nvd.nist.gov/vuln/detail/CVE-2025-5419
github.com/advisories/GHSA-x828-wp24-7h9m
Show 24 moreShow less
security.alpinelinux.org/vuln/CVE-2025-5419
security-tracker.debian.org/tracker/CVE-2025-5419
advisories.mageia.org/MGASA-2025-0187.html
bugs.mageia.org/show_bug.cgi?id=34340
suse.com/security/cve/CVE-2025-5063
Left out here: 340 versions. The JSON record has them.