Executive brief
Google Chrome and other Chromium-based browsers (like Microsoft Edge and Opera) are affected by a critical security flaw in their JavaScript engine. By tricking a user into visiting a specially crafted website, an attacker can gain the ability to read or write data within the browser's memory. This could lead to the theft of sensitive information or the execution of malicious code on the user's device. This vulnerability is known to be actively exploited in the wild.
Technical details
A type confusion vulnerability (CWE-843) exists in the V8 JavaScript engine within Google Chromium. The flaw occurs when the engine incorrectly interprets the type of an object, allowing for out-of-bounds memory access. A remote, unauthenticated attacker can exploit this by hosting a malicious HTML page; when a user visits the page, the attacker can perform arbitrary memory read and write operations. This can be used as a primitive for remote code execution (RCE) or to bypass security sandboxes. The vulnerability is confirmed to be exploited in the wild and is patched in Chrome version 138.0.7204.96 and later.
Affected products
- Google Chrome prior to 138.0.7204.96
- Google Chromium prior to 138.0.7204.96
- Microsoft Edge All versions based on affected Chromium releases
- Opera Software Opera All versions based on affected Chromium releases
Timeline
- 2025-06-30: disclosed: Initial disclosure by Google Chrome team
- 2025-06-30: patched: Fixed in Chrome version 138.0.7204.96
- 2025-07-02: kev added: Added to CISA Known Exploited Vulnerabilities catalog