Google fixed the seventh Chrome zero-day in 2025

Google patched two Chrome flaws, including a high-severity V8 type-confusion bug tracked as CVE-2025-13223 that has been actively exploited in the wild, according to NIST’s advisory.

The flaw impacts the V8 script engine in Google Chrome before 142.0.7444.175, and a quote from the advisory notes that “Type Confusion in V8 in Google Chrome prior to 142.0.7444.175 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.” Clément Lecigne of Google’s Threat Analysis Group reported the vulnerability on 12 November 2025, and Google is aware that an exploit for CVE-2025-13223 exists in the wild.

Users are advised to update Chrome to version 142.0.7444.175 or 142.0.7444.176, depending on OS, and relaunch to apply fixes. CVE-2025-13223 is the seventh Chrome zero-day vulnerability actively exploited in 2025.