Chrome 142 Update Patches Exploited Zero-Day

Google on Monday rolled out an emergency Chrome 142 update to address a vulnerability exploited in the wild as a zero-day. Tracked as CVE-2025-13223 (CVSS 8.8), the exploited high-severity flaw is described as a type confusion issue in the V8 JavaScript and WebAssembly engine, with memory safety defects that could trigger remote code execution. Type confusion defects in the V8 engine can typically be exploited via crafted HTML pages for remote read/write operations.

Google notes in its advisory that an exploit for CVE-2025-13223 exists in the wild, and says the vulnerability was reported by Clément Lecigne of Google’s Threat Analysis Group on 12 November, implying that a commercial spyware vendor might have targeted the bug. CVE-2025-13224, another type confusion issue in V8, is also resolved in this update, though Google does not state it was exploited in the wild. The latest Chrome iteration is now rolling out as version 142.0.7444.175 for Linux, 142.0.7444.176 for macOS, and 142.0.7444.175/176 for Windows.