Loading story…
A high-severity vulnerability, tracked as CVE-2025-13042, was identified in the V8 JavaScript engine of Google Chrome, allowing remote attackers to exploit heap corruption through specially crafted HTML pages. This flaw could enable remote code execution on affected systems, posing significant risks to users who visit malicious websites. Google released an emergency fix to address the issue, urging users to update their browsers immediately to mitigate potential exploitation.
The vulnerability affects Google Chrome versions prior to 142.0.7444.166, and its severity is underscored by a CVSS score of 8.8. Security advisories highlight that the flaw is remotely exploitable and could be leveraged by attackers to gain control over vulnerable systems. Organizations are advised to prioritize patching and monitor for any signs of exploitation in their environments.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Public vulnerability tracking for CVE-2025-13042 described the issue as a Google Chrome heap corruption flaw affecting the V8 engine. This made the vulnerability details broadly available through CVE tracking sources on November 12, 2025.
Google released an emergency fix for the high-severity Chrome V8 heap corruption vulnerability tracked as CVE-2025-13042, which could allow remote code execution. The references indicate the issue was publicly disclosed as a Chrome security update on November 12, 2025.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released Chrome fixes for multiple high-severity vulnerabilities in the V8 JavaScript engine, including `CVE-2025-10891`, `CVE-2025-10892`, and `CVE-2025-9864`, that could be triggered when a user visits a malicious web page. The flaws include integer overflows and a use-after-free condition that can cause heap corruption in the browser renderer and potentially lead to arbitrary code execution. A related bulletin also lists `CVE-2025-10890`, a V8 side-channel information disclosure issue, alongside the two integer overflow bugs, warning that successful exploitation could expose sensitive data or enable full system compromise. Google said the affected Chrome builds were patched across Windows, macOS, and Linux in the `140.0.7339` release line, with fixes landing in versions including `140.0.7339.80/.81` and later `140.0.7339.207/.208` depending on the flaw and platform. Several of the vulnerabilities were reportedly identified by Google’s AI-based Big Sleep system, and no public proof-of-concept exploits were cited in the referenced reports. Organizations using Chrome or Chromium-based browsers were urged to deploy the vendor updates promptly because the bugs are reachable through routine web browsing and may also affect downstream browsers that have not yet incorporated the upstream patches.
Jun 29, 2026
Google has released an emergency security update to address CVE-2025-13223, a critical zero-day vulnerability in the V8 JavaScript engine used by Chrome and Chromium-based browsers. This type confusion flaw, discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG), allows attackers to achieve heap corruption and potentially execute arbitrary code simply by luring users to maliciously crafted websites. The vulnerability has been actively exploited in the wild, with Google confirming that threat actors are weaponizing it to bypass browser sandbox protections, steal credentials, escalate privileges, and deploy malware. The fix is included in Chrome version 142.0.7444.175/.176 for Windows, Mac, and Linux, and users are strongly urged to update and restart their browsers immediately to mitigate risk. Other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are also rolling out patches. The involvement of Google TAG suggests possible links to advanced persistent threats, highlighting the urgency for both individuals and enterprises to apply updates and monitor for suspicious activity.
Jun 29, 2026
Google released a security advisory addressing a vulnerability in Chrome for Desktop, affecting versions prior to 141.0.7390.122/.123 on Windows and Mac, and 141.0.7390.122 on Linux. The flaw, identified as a high-severity issue in the V8 JavaScript engine (CVE-2025-12036), could allow attackers to exploit affected systems if not promptly patched. Security authorities have urged users and administrators to review the advisory and apply the necessary updates to mitigate potential risks. The vulnerability in the V8 engine requires immediate attention due to its potential impact on system security. Organizations are advised to ensure all Chrome installations are updated to the latest stable versions to prevent exploitation. No evidence of active exploitation has been reported, but the critical nature of the flaw underscores the importance of timely patching to maintain secure environments.
Jun 29, 2026