Chrome: Out of bounds read and write in V8 engine (CVE-2025-5419) #shorts

Summary

Google has released an emergency patch for CVE-2025-5419, a high-severity zero-day vulnerability in the V8 JavaScript engine of Google Chrome. This flaw is being actively exploited in the wild and can lead to heap corruption and potentially arbitrary code execution via a crafted HTML page.

Product details

Affected product: Google Chrome prior to version 137.0.7151.68. The issue resides in the V8 JavaScript engine component. All desktop and mobile Chrome installations running a version less than 137.0.7151.68 must be updated immediately to receive the patch.

Vulnerability type summary

CVE-2025-5419 is classified as an out-of-bounds read and write vulnerability. Such bugs allow an attacker to read or write memory outside the bounds of allocated buffers, leading to heap corruption and enabling remote code execution under certain conditions.

Details of the vulnerability

The flaw exists in V8’s handling of certain JavaScript objects when parsing and executing HTML content. A remote attacker can craft a malicious page that triggers out-of-bounds reads and writes, corrupting the heap. Successful exploitation can allow execution of attacker-controlled code with the privileges of the browser process. Reports indicate real-world exploit chains leveraging this vulnerability against unpatched Chrome users.

Conclusion

All Chrome users should update to version 137.0.7151.68 or later without delay. Enterprises should deploy the emergency patch via their update management systems, review browser logs for suspicious activity, and monitor for indicators of compromise related to in-the-wild exploitation of CVE-2025-5419.

Watch the full video on YouTube: CVE-2025-5419

Remediation and exploitation details

This chain involves the following actors

  • Remote attacker: Prepares and delivers malicious content to exploit the browser
  • Chrome user: Innocent end user who visits the crafted web page and unwittingly triggers the exploit

This following systems are involved

  • Google Chrome (prior to 137.0.7151.68) (Rendering and displaying web content): Target browser
  • V8 JavaScript engine (Parsing and executing JavaScript code in web pages): Vulnerable component where out-of-bounds memory access occurs

Attack entry point

  • Crafted HTML page: A malicious web page hosting specially designed JavaScript that triggers the out-of-bounds read/write bug

Remediation actions

Chrome user
Update Google Chrome to version 137.0.7151.68 or later
Google Chrome
System administrator
Enforce automatic browser updates and verify version compliance
Google Chrome

Exploitation actions

Send link via phishing email or embed in compromised site

Remote attacker
Hosts malicious HTML page on a web server
Google Chrome
Examples:
  • Email with link to http://evil.example.com/malicious.html

Navigates in browser to the attacker’s URL

Chrome user
Clicks link and loads the malicious page
Google Chrome
Examples:
  • User opens the link in a new tab

Prepare heap memory for corruption

Exploit code
Allocates a typed array with attacker-controlled size and layout
V8 JavaScript engine
Examples:
  • var arr = new Uint32Array(0x100);

Use a crafted index calculation to overwrite object headers

Exploit code
Performs out-of-bounds write to adjacent object memory
V8 JavaScript engine
Examples:
  • arr[calculatedIndex] = shellcodeAddress;

Redirect JavaScript execution flow to attacker data

Exploit code
Overwrites internal pointer or function map
V8 JavaScript engine
Examples:
  • Modify the backing store pointer of a typed array to point at shellcode

Invoke a method or function call whose pointer has been hijacked

Exploit code
Triggers execution of corrupted memory region
V8 JavaScript engine
Examples:
  • Call the overwritten function to run shellcode

Use the newly gained code execution to fetch additional malware

Exploit code
Downloads and runs secondary payload
Operating system
Examples:
  • Create a new process to download ransomware or spyware

Related Content

NOTE: The following related content has not been vetted and may be unsafe.

CVE database technical details

CVE ID
CVE-2025-5419
Description
Out of bounds read and write in V8 in Google Chrome prior to 137.0.7151.68 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Provider
Chrome
CWE / problem types
Out of bounds read and write
Affected Software Versions
Google:Chrome:[{'version': '137.0.7151.68', 'status': 'affected', 'lessThan': '137.0.7151.68', 'versionType': 'custom'}]
Date Published
2025-06-02T23:36:53.221Z
Last Updated
2025-06-05T22:20:22.814Z