U.S. CISA adds a Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog

U.S. CISA added a Google Chromium V8 flaw to its Known Exploited Vulnerabilities catalog, tracked as CVE-2025-13223. Google Chrome’s V8 engine contains a high-severity type confusion issue that can be triggered by a crafted HTML page to achieve code execution or cause crashes, and it affects Chrome before 142.0.7444.175. Clément Lecigne of Google’s Threat Analysis Group reported the vulnerability on 12 November 2025, and Google notes that an exploit exists in the wild.

According to Binding Operational Directive (BOD) 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, CISA orders federal agencies to fix the vulnerabilities by 10 December 2025.