Chrome Emergency Update: Google Patches Actively Exploited V8 Zero-Day (CVE-2025-13223)
Google has released new updates for the Chrome browser amid yet another wave of attacks exploiting a flaw in the V8 engine. The company confirmed that one of the vulnerabilities is already being weaponized in real-world incidents, prompting an immediate rollout of patches.
The primary issue is CVE-2025-13223, rated 8.8, a type-handling error within V8 that can lead to memory corruption. Under the right conditions, a remote attacker could execute arbitrary code via a specially crafted HTML page.
The flaw was reported by Clément Lecigne of Google’s Threat Analysis Group, who detected the issue on November 12. While the company has not disclosed who may be targeting the vulnerability or the scale of the attacks, it confirms that a functioning exploit is already in circulation.
This marks the third actively exploited V8-class anomaly this year, joining CVE-2025-6554 and CVE-2025-10585. Google also patched another similar engine-level issue — CVE-2025-13224, discovered by the company’s internal AI agent, Big Sleep. Both flaws received identical severity scores due to their potential to enable arbitrary system actions.
Google notes that with the November release, the number of zero-day vulnerabilities fixed in Chrome since the beginning of the year has reached seven. The list also includes CVE-2025-2783, CVE-2025-4664, CVE-2025-5419, CVE-2025-6558, and others.
To minimize risk, users are urged to install the latest browser versions:
- 142.0.7444.175 or .176 for Windows
- 142.0.7444.176 for macOS
- 142.0.7444.175 for Linux
Updates can be checked via Help → About Google Chrome, followed by restarting the browser. Users of Edge, Brave, Opera, and Vivaldi should likewise await corresponding updates in their respective releases.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
