# CVE-2025-13223: Google Chrome type confusion in V8 engine

Source: https://junglewise.ai/threats/cve-2025-13223-google-chrome-type-confusion-in-v8-engine  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2025-11-17. Updated: 2026-07-14  
License: CC BY 4.0 with a link back

CVE-2025-13223 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-11-17

Google Chrome is a widely used web browser, and the V8 component is the engine responsible for executing JavaScript. A security flaw has been identified that allows a remote attacker to corrupt the browser's memory when a user visits a specially crafted website. This could lead to the theft of sensitive information, unauthorized access to user accounts, or the execution of malicious code on the victim's computer. Google has confirmed that this vulnerability is being actively exploited in the wild.

Technologies: [Apple macOS](https://junglewise.ai/threats/technologies/macos), [Google Chrome](https://junglewise.ai/threats/technologies/chrome), [Google Chromium V8](https://junglewise.ai/threats/technologies/chromium-v8), [Linux Kernel](https://junglewise.ai/threats/technologies/kernel), [Microsoft Windows](https://junglewise.ai/threats/technologies/windows). Vendors: [Apple](https://junglewise.ai/threats/vendors/apple), [Google](https://junglewise.ai/threats/vendors/google), [Linux](https://junglewise.ai/threats/vendors/linux), [Microsoft](https://junglewise.ai/threats/vendors/microsoft), [Siemens](https://junglewise.ai/threats/vendors/siemens).

## Quick answers

**Is CVE-2025-13223 exploited in the wild?** Yes. CVE-2025-13223 is known to be exploited in the wild, first recorded on 19 November 2025. Treat it as urgent.

**How severe is CVE-2025-13223?** Critical severity, with a CVSS score of 8.8, published 17 November 2025.

**Which products and versions are affected?** Google Chrome prior to 142.0.7444.175; Siemens CADRA All versions.

**Is there a fix for CVE-2025-13223?** A patch was published on 2025-11-17: Chrome version 142.0.7444.175 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2025-13223 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2025-13223?** Check whether you run Apple macOS, Google Chrome, Google Chromium V8 or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A type confusion vulnerability (CWE-843) exists in the V8 JavaScript engine within Google Chrome. The flaw is triggered when the engine incorrectly handles object types during execution, leading to heap corruption. A remote, unauthenticated attacker can exploit this by enticing a user to visit a malicious HTML page. Successful exploitation can result in arbitrary code execution within the browser's sandbox or a process crash. Google has acknowledged active exploitation (zero-day) of this flaw. The issue is resolved in Chrome version 142.0.7444.175 and later. Siemens CADRA is also noted as affected due to its reliance on vulnerable components.

## Affected products

- Google Chrome prior to 142.0.7444.175
- Siemens CADRA All versions

## Timeline

- 2025-11-12: disclosed: Reported by Google Threat Analysis Group
- 2025-11-17: patched: Chrome version 142.0.7444.175 released
- 2025-11-17: advisory: Initial Google Chrome security advisory published
- 2025-11-17: exploited: Google confirmed exploit exists in the wild
- 2025-11-19: kev added: Added to CISA Known Exploited Vulnerabilities Catalog
- 2026-07-14: advisory: Siemens published advisory SSA-470355 regarding CADRA impact

## References

- [https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html](https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.html)
- [https://issues.chromium.org/issues/460017370](https://issues.chromium.org/issues/460017370)
- [https://cert-portal.siemens.com/productcert/html/ssa-470355.html](https://cert-portal.siemens.com/productcert/html/ssa-470355.html)

## Related threats

- [Google Chrome out of bounds read in Skia](https://junglewise.ai/threats/cve-2026-126922-out-of-bounds-read-in-skia-in-google-chrome-prior-to-157-0-8103)
- [Google Chrome use after free in Accessibility](https://junglewise.ai/threats/cve-2026-126921-use-after-free-in-accessibility-in-google-chrome-prior-to-157-0)
- [Google Chrome information leak in Skia](https://junglewise.ai/threats/cve-2026-126920-information-leak-in-skia-in-google-chrome-prior-to-157-0-8103-78)
- [Google Chrome use-after-free in BrowserTag](https://junglewise.ai/threats/cve-2026-126919-use-after-free-in-browsertag-in-google-chrome-prior-to-157-0)
- [Google Chrome use-after-free in Layout](https://junglewise.ai/threats/cve-2026-126918-use-after-free-in-layout-in-google-chrome-prior-to-157-0-8103-78)