CVE-2025-5419
Published: June 5, 2025
Official Description
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA KEV Advisory
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Google Chromium V8 contains an out-of-bounds read and write vulnerability that could allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
This out-of-bounds read and write vulnerability in Google Chromium V8 could allow a remote attacker to exploit heap corruption via a crafted HTML page. Despite the lack of a CVSS score, its HIGH severity and confirmed exploitation in the wild by CISA make it a critical vulnerability. The EPSS score of 0.02112, while low, is superseded by the confirmed active exploitation.
This vulnerability is actively being exploited in the wild, as confirmed by its inclusion in CISA's KEV catalog. It is remotely exploitable, allowing an attacker to potentially exploit heap corruption through a crafted HTML page.
Users of web browsers utilizing Chromium V8, such as Google Chrome, Microsoft Edge, and Opera, should update to the latest versions. Regular patching is crucial to protect against such remotely exploitable flaws.
Technical Analysis
CVE-2025-5419 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2025-5419 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
All References (2)
Quick Facts
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-5419 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1