Google Patches Exploited Chrome Zero-Day Vulnerability

Google issued an emergency security update for its Chrome browser on November 17, 2025, addressing a high-severity zero-day vulnerability that security researchers confirmed is being actively exploited in real-world attacks. The flaw, tracked as CVE-2025-13223, affects the V8 JavaScript and WebAssembly engine and could allow remote attackers to corrupt memory and potentially execute malicious code through a specially crafted HTML page.

The vulnerability stems from a type confusion issue in V8, where the software misinterprets data types, leading to heap corruption. According to the National Institute of Standards and Technology, this bug in Chrome versions prior to 142.0.7444.175 enables a remote attacker to exploit the problem via malicious web content, earning it a high severity rating with a CVSS score of 8.8. Google stated it is aware of an exploit existing in the wild but has withheld technical details to prevent further abuse until most users apply the fix. "Access to bug details and links may be kept restricted until a majority of users are updated with a fix," the company noted in its advisory.

Discovered on November 12, 2025, by Clément Lecigne of Google's Threat...