CVE-2025-0999 - Vulnerability Details

Vendors	Products
Google	Chrome

Link	Providers
https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html
https://issues.chromium.org/issues/394350433

Type	Values Removed	Values Added
First Time appeared		Google Google chrome
CPEs		cpe:2.3:a:google:chrome::::::::
Vendors & Products		Google Google chrome

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Weaknesses		CWE-122
References		https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html https://issues.chromium.org/issues/394350433

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0999", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2025-02-03T18:04:39.217Z", "datePublished": "2025-02-19T16:55:30.675Z", "dateUpdated": "2025-02-19T20:08:12.953Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "133.0.6943.126", "status": "affected", "lessThan": "133.0.6943.126", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Heap buffer overflow", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2025-02-19T16:55:30.675Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html"}, {"url": "https://issues.chromium.org/issues/394350433"}]}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "cweId": "CWE-122", "lang": "en", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-02-19T20:05:30.688228Z", "id": "CVE-2025-0999", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T20:08:12.953Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-0999 (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

state : PUBLISHED (string)

assignerShortName : Chrome (string)

dateReserved : 2025-02-03T18:04:39.217Z (string)

datePublished : 2025-02-19T16:55:30.675Z (string)

dateUpdated : 2025-02-19T20:08:12.953Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

version : 133.0.6943.126 (string)

status : affected (string)

lessThan : 133.0.6943.126 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Heap buffer overflow (string)

cweId : CWE-122 (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2025-02-19T16:55:30.675Z (string)

}

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/394350433 (string)

}

]

}

adp : [ »

0 : { »

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

type : CWE (string)

cweId : CWE-122 (string)

lang : en (string)

description : CWE-122 Heap-based Buffer Overflow (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.8 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-02-19T20:05:30.688228Z (string)

id : CVE-2025-0999 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-19T20:08:12.953Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-0999", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2025-02-03T18:04:39.217Z", "datePublished": "2025-02-19T16:55:30.675Z", "dateUpdated": "2025-02-19T20:08:12.953Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "133.0.6943.126", "status": "affected", "lessThan": "133.0.6943.126", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Heap buffer overflow", "cweId": "CWE-122"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2025-02-19T16:55:30.675Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html"}, {"url": "https://issues.chromium.org/issues/394350433"}]}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-0999", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-19T20:05:30.688228Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-122", "description": "CWE-122 Heap-based Buffer Overflow"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-19T20:06:11.791Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-0999 (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

state : PUBLISHED (string)

assignerShortName : Chrome (string)

dateReserved : 2025-02-03T18:04:39.217Z (string)

datePublished : 2025-02-19T16:55:30.675Z (string)

dateUpdated : 2025-02-19T20:08:12.953Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

version : 133.0.6943.126 (string)

status : affected (string)

lessThan : 133.0.6943.126 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Heap buffer overflow (string)

cweId : CWE-122 (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2025-02-19T16:55:30.675Z (string)

}

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/394350433 (string)

}

]

}

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 8.8 (number)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

integrityImpact : HIGH (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : HIGH (string)

privilegesRequired : NONE (string)

confidentialityImpact : HIGH (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-0999 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-02-19T20:05:30.688228Z (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-122 (string)

description : CWE-122 Heap-based Buffer Overflow (string)

}

]

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-02-19T20:06:11.791Z (string)

}

]

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "E9DA9F76-5EF4-4573-B0DD-633D553032C7", "versionEndExcluding": "133.0.6943.126", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)"}, {"lang": "es", "value": "El desbordamiento del b\u00fafer del mont\u00f3n en V8 en Google Chrome antes de 133.0.6943.126 permiti\u00f3 a un atacante remoto explotar potencialmente la corrupci\u00f3n del mont\u00f3n a trav\u00e9s de una p\u00e1gina HTML manipulada. (Gravedad de seguridad de Chromium: Alta)"}], "id": "CVE-2025-0999", "lastModified": "2025-04-07T19:07:22.060", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-02-19T17:15:14.930", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes"], "url": "https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Issue Tracking", "Permissions Required"], "url": "https://issues.chromium.org/issues/394350433"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-122"}], "source": "chrome-cve-admin@google.com", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-122"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (string)

matchCriteriaId : E9DA9F76-5EF4-4573-B0DD-633D553032C7 (string)

versionEndExcluding : 133.0.6943.126 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Heap buffer overflow in V8 in Google Chrome prior to 133.0.6943.126 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (string)

}

1 : { »

lang : es (string)

value : El desbordamiento del búfer del montón en V8 en Google Chrome antes de 133.0.6943.126 permitió a un atacante remoto explotar potencialmente la corrupción del montón a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Alta) (string)

}

]

id : CVE-2025-0999 (string)

lastModified : 2025-04-07T19:07:22.060 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 5.9 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2025-02-19T17:15:14.930 (string)

references : [ »

0 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Release Notes (string)

]

url : https://chromereleases.googleblog.com/2025/02/stable-channel-update-for-desktop_18.html (string)

}

1 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Issue Tracking (string)

1 : Permissions Required (string)

]

url : https://issues.chromium.org/issues/394350433 (string)

}

]

sourceIdentifier : chrome-cve-admin@google.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-122 (string)

}

]

source : chrome-cve-admin@google.com (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-122 (string)

}

]

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object