Stories
Slash Boxes
Comments

SoylentNews is people

SoylentNews is powered by your submissions, so send in your scoop. Only 15 submissions in the queue.

Google Chrome Bug Exploited as an 0-Day - Patch Now or Risk Full System Compromise

posted by hubie on Friday November 21, @07:10PM   Printer-friendly
Security

An Anonymous Coward writes:

https://www.theregister.com/2025/11/18/google_chrome_seventh_0_day/

Seventh Chrome 0-day this year

Google pushed an emergency patch on Monday for a high-severity Chrome bug that attackers have already found and exploited in the wild.

The vulnerability, tracked as CVE-2025-13223, is a type confusion flaw in the V8 JavaScript engine, and it's the seventh Chrome zero-day this year. All have since been patched. But if you use Chrome as your web browser, make sure you are running the most recent version - or risk full system compromise.

This type of vulnerability happens when the engine misinterprets a block of memory as one type of object and treats it as something it's not. This can lead to system crashes and arbitrary code execution, and if it's chained with other bugs can potentially lead to a full system compromise via a crafted HTML page.

"Google is aware that an exploit for CVE-2025-13223 exists in the wild," the Monday security alert warned.

Also on Monday, Google issued a second emergency patch for another high-severity type confusion bug in Chrome's V8 engine. This one is tracked as CVE-2025-13224. As of now, there's no reports of exploitation - so that's another reason to update sooner than later.

Google's LLM-based bug hunting tool Big Sleep found CVE-2025-13224 in October, and a human - the Chocolate Factory's own Clément Lecigne - discovered CVE-2025-13223 on November 12.

Lecigne is a spyware hunter with Google's Threat Analysis Group (TAG) credited with finding and disclosing several of these types of Chrome zero-days. While we don't have any details about who is exploiting CVE-2025-13223 and what they are doing with the access, TAG tracks spyware and nation-state attackers abusing zero days for espionage expeditions.

TAG also spotted the sixth Chrome bug exploited as a zero-day and patched in September. That flaw, CVE-2025-10585, was also a type confusion flaw in the V8 JavaScript and WebAssembly engine.

Original Submission


«  China Cuts Open New Robot on Stage to Prove Authenticity | Kaspersky Antivirus is Now Available for Linux. Will You Use It?  »
This discussion was created by hubie (1068) for logged-in users only, but now has been archived. No new comments can be posted.
Google Chrome Bug Exploited as an 0-Day - Patch Now or Risk Full System Compromise | Log In/Create an Account | Top | 6 comments | Search Discussion
Display Options Threshold/Breakthrough Mark All as Read Mark All as Unread
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
(1)

  • (Score: 3, Insightful) by Anonymous Coward on Friday November 21, @07:14PM (4 children)

    by Anonymous Coward on Friday November 21, @07:14PM (#1424884)

    Time to depreciate

    • (Score: 5, Interesting) by Anonymous Coward on Friday November 21, @07:43PM (1 child)

      by Anonymous Coward on Friday November 21, @07:43PM (#1424887)

      The whole concept of JavaScript in web browsers is completely insane.

      "Let's write a program which automatically downloads and executes untrusted third party software from strangers on the internet. Then, we maintain a long list of rules describing all the things that this software is not allowed to do, so scoundrels won't be able to do anything nefarious."

      "Don't worry, we've only had to update the list of rules over 9000 times already, but I'm sure that we've got it right this time and no further updates will be required."

      • (Score: 0) by Anonymous Coward on Sunday November 23, @08:35AM

        by Anonymous Coward on Sunday November 23, @08:35AM (#1425003)

        https://lists.w3.org/Archives/Public/www-html/2002May/0021.html [w3.org]

        Is there a tag to tell the browser to turn off/ignore active content
        especially for security reasons (I know it's debateable what active content
        is, but scripts and active-x would be a good start). By turning "off" I
        don't mean that stuff that is already running should be turned off. It is
        more of telling the browser to ignore active content between certain points
        (active content quoting).

        Eventually the answer apparently was CSP: https://en.wikipedia.org/wiki/Content_Security_Policy [wikipedia.org]

    • (Score: 5, Funny) by turgid on Friday November 21, @10:17PM (1 child)

      by turgid (4318) Subscriber Badge on Friday November 21, @10:17PM (#1424895) Journal

      But web assembly!!!

      • (Score: 5, Insightful) by krishnoid on Friday November 21, @11:32PM

        by krishnoid (1156) on Friday November 21, @11:32PM (#1424897)

        Indeed! That also allows for much better permission control.

        Warning: This webpage contains a script that wants to:

        • Load a string constant into a register. Allow or Disallow?
        • Load an integer constant into a register. Allow or Disallow?
        • Add two registers and store the results in another register. Allow or Disallow?
        • Insert an element into the DOM object. Allow or Disallow?
        • Delete an element from the DOM object. Allow or Disallow?

        etc., etc.

  • (Score: 0) by Anonymous Coward on Saturday November 22, @06:23PM

    by Anonymous Coward on Saturday November 22, @06:23PM (#1424965)

    No corporate browser should be kept on anything but a VERY short leash.

(1)