CISA Warns of Google Chrome 0-Day Vulnerability Exploited in Attacks

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert about a zero-day vulnerability in Google Chrome, actively exploited by threat actors.

CVE-2025-13223 is a flaw in the Chromium V8 JavaScript engine that poses significant risks to users worldwide, potentially enabling remote code execution and data breaches.

The vulnerability stems from a type confusion error, classified under CWE-843, which tricks the browser into mishandling data types and corrupts the heap memory. Discovered and patched by Google on November 19, 2025, via its stable channel update, the issue affects Chrome versions before 131.0.6778.72.

Attackers have already leveraged it in the wild, though details on specific campaigns remain limited. CISA added it to its Known Exploited Vulnerabilities (KEV) catalog the same day, mandating federal agencies to apply mitigations by December 10, 2025.

Vulnerability Breakdown and Affected Systems

This zero-day targets the core of Chrome’s rendering engine, making it a prime vector for drive-by downloads and malicious interactions on websites.

While primarily affecting desktop users on Windows, macOS, and Linux, the flaw extends to Chromium-based browsers such as Microsoft Edge and Brave.

CVE ID	Affected Products	Impact	Exploit Prerequisites	CVSS Score
CVE-2025-13223	Google Chrome (versions < 131.0.6778.72), Chromium-based browsers	Heap corruption leading to remote code execution	Visiting malicious websites; no user interaction required beyond rendering	8.8 (High)

No confirmed ties to ransomware exist yet, but experts warn of potential escalation in phishing and supply chain attacks.

CISA urges immediate updates to the latest Chrome version, available through Google’s release notes. In cloud environments, agencies must align with Binding Operational Directive 22-01 and emphasize zero-trust principles. If patches aren’t feasible, discontinuing the product is advised to curb risks.

This incident underscores the relentless pace of browser threats, especially in V8’s complex codebase. With over 3 billion users, Chrome’s dominance amplifies the stakes, as unpatched systems could fuel widespread compromises.

Security researchers highlight the need for vigilant monitoring, as zero-days like this often precede larger campaigns.

As exploitation continues, organizations should scan networks for indicators of compromise and educate users on safe browsing. Google’s swift response mitigates much of the danger, but proactive patching remains key to staying ahead of adversaries.

Follow us on Google News, LinkedIn, and X for daily cybersecurity updates. Contact us to feature your stories.