CVE-2025-13223

HighCVSS 8.8/10Known exploited (CISA KEV)Last modified Jul 14, 2026

Description

Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-843

Affected software

Vendor	Product	Versions
Google	Chrome	< 142.0.7444.175
Siemens	CADRA	< *

References

https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop_17.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/460017370Issue Tracking, Permissions Required
https://cert-portal.siemens.com/productcert/html/ssa-470355.htmlThird Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-13223US Government Resource

Timeline

Published: Nov 17, 2025
Last modified: Jul 14, 2026
Added to CISA KEV: Nov 19, 2025
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-132248.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-132256.0Tanium addressed an arbitrary file deletion vulnerability in TanOS.CVE-2025-132268.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-132278.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-132288.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-132298.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-13239.8The WP-Recall – Registration, Profile, Commerce & More plugin for WordPress is vulnerable to SQL Injection via the 'databeat' parameter in a CVE-2025-132308.8Type Confusion in V8 in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to potentially exploit heap corruption via a crafted CVE-2025-132316.5The Fancy Product Designer plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 6.4.8. Th CVE-2025-132323.5A flaw has been found in projectsend up to r1720. Impacted is an unknown function of the component File Editor/Custom Download Aliases. This CVE-2025-132339.8A vulnerability has been found in itsourcecode Inventory Management System 1.0. The affected element is an unknown function of the file /ind CVE-2025-132349.8A vulnerability was found in itsourcecode Inventory Management System 1.0. The impacted element is an unknown function of the file /index.ph