CVE-2025-5419: Google Chromium V8 out-of-bounds read and write

CVE-2025-5419 · Severity: critical · CVSS 8.8 · Exploited in the wild · Published 2025-06-05

Google Chrome and other Chromium-based browsers like Microsoft Edge are affected by a critical security flaw in their JavaScript engine. An attacker can exploit this by tricking a user into visiting a specially crafted website, potentially leading to unauthorized access to data or the ability to run malicious code on the user's computer. This vulnerability is known to be actively exploited in the wild, making immediate updates essential to protect corporate data and user privacy.

Technologies: Google Chrome, Google Chromium V8, Microsoft Edge. Vendors: Google, Microsoft.

Quick answers

Is CVE-2025-5419 exploited in the wild?
Yes. CVE-2025-5419 is known to be exploited in the wild, first recorded on 5 June 2025. Treat it as urgent.
How severe is CVE-2025-5419?
Critical severity, with a CVSS score of 8.8, published 5 June 2025.
Which products and versions are affected?
Google Chrome prior to 137.0.7151.68; Microsoft Edge prior to 137.0.3296.62.
Is there a fix for CVE-2025-5419?
A patch was published on 2025-06-05: Stable channel updates released for Chrome and Edge Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2025-5419 attacked?
It is attacked over the network, in a network appliance.
Am I affected by CVE-2025-5419?
Check whether you run Google Chrome, Google Chromium V8 or Microsoft Edge at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

An out-of-bounds (OOB) read and write vulnerability exists in the V8 JavaScript engine within Google Chromium. The flaw is triggered when the engine improperly handles memory access during the processing of JavaScript, leading to heap corruption. A remote, unauthenticated attacker can exploit this by hosting a malicious HTML page and inducing a user to visit it. Successful exploitation can result in arbitrary code execution within the browser's sandbox or information disclosure. This vulnerability has been observed in active attacks. Users should update Google Chrome to version 137.0.7151.68 or later and Microsoft Edge to version 137.0.3296.62 or later.

Affected products

  • Google Chrome prior to 137.0.7151.68
  • Microsoft Edge Chromium prior to 137.0.3296.62

Timeline

  • 2025-06-02: disclosed
  • 2025-06-05: kev added: Added to CISA Known Exploited Vulnerabilities catalog
  • 2025-06-05: patched: Stable channel updates released for Chrome and Edge

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.