CVE-2025-3066

HighCVSS 8.8/10Last modified Jun 17, 2026

Description

Use after free in Site Isolation in Google Chrome prior to 135.0.7049.84 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 135.0.7049.84, < 135.0.7049.84

References

https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.htmlRelease Notes
https://issues.chromium.org/issues/405140652Issue Tracking, Permissions Required

Timeline

Published: Apr 2, 2025
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2025

CVE-2025-306607.5An Improper Check for Unusual or Exceptional Conditions vulnerability in the Packet Forwarding Engine (pfe) of Juniper Networks Junos OS on CVE-2025-306617.3An Incorrect Permission Assignment for Critical Resource vulnerability in line card script processing of Juniper Networks Junos OS allows a CVE-2025-306626.5Symlink following in the installer for the Zoom Workplace VDI Plugin macOS Universal installer before version 6.3.14, 6.4.14, and 6.5.10 in CVE-2025-306637.0Time-of-check time-of-use race condition in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege v CVE-2025-306648.2Cross-site scripting in some Zoom Workplace Apps may allow an authenticated user to conduct an escalation of privilege via local access.CVE-2025-306656.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306666.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306676.5NULL pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network CVE-2025-306686.5Integer underflow in some Zoom Workplace Apps may allow an authenticated user to conduct a denial of service via network access.CVE-2025-306696.5Improper certificate validation in certain Zoom Clients may allow an unauthenticated user to conduct a disclosure of information via adjacen CVE-2025-30678.8Inappropriate implementation in Custom Tabs in Google Chrome on Android prior to 135.0.7049.52 allowed a remote attacker who convinced a use CVE-2025-306706.5Null pointer dereference in some Zoom Workplace Apps for Windows may allow an authenticated user to conduct a denial of service via network