CVE-2025-5419: Google Chrome V8 out-of-bounds read and write enables heap corruption

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

high priorityCVSS 8.8 with confirmed in-the-wild exploitation per CISA KEV and a short remediation deadline, though it requires user interaction and no ransomware use is documented.

What it is

V8 in Google Chrome before 137.0.7151.68 contains an out-of-bounds read and write that a remote attacker can trigger with a crafted HTML page, leading to heap corruption. The flaw is rated High by Chromium and carries a CVSS 3.1 base score of 8.8, and it affects both Chrome and Chromium-based Microsoft Edge.

Impact

An attacker who lands the corruption can potentially achieve code execution or crash the renderer in the browser process context, giving high confidentiality, integrity and availability impact.

Attack surface

Reached over the network by loading a crafted HTML page; no privileges are required but the victim must interact with the page (UI:R), so it is a drive-by or lure-based browser attack.

Exploitation

CVE-2025-5419 was added to CISA KEV on 2025-06-05 with a 2025-06-26 remediation due date, indicating known exploitation in the wild; EPSS 30-day probability is 0.078 (94th percentile). No ransomware campaign use is documented.

What to do

• Update Google Chrome to 137.0.7151.68 or later and Microsoft Edge to the corresponding fixed Chromium build immediately.
• Apply vendor mitigations per CISA BOD 22-01 guidance for cloud services, or discontinue use of unpatched browsers.
• Enforce automatic browser updates and verify version compliance across endpoints.
• Restrict or sandbox untrusted web content and block known malicious domains where feasible.
• Monitor for exploitation attempts against exposed browser users and prioritize patching internet-facing endpoints.

Detection

• Hunt for browser crashes or renderer process terminations consistent with V8 heap corruption on endpoints running Chrome below 137.0.7151.68.
• Review proxy, DNS and EDR telemetry for delivery of crafted HTML pages or exploit kit activity targeting browser users.
• Audit asset inventories for Chrome and Edge versions and flag any host not on the fixed Chromium build.
• Correlate CISA KEV due-date compliance reporting with endpoint patch status for CVE-2025-5419.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.