Google Issues Security Fix for Actively Exploited Chrome V8 Zero-Day Vulnerability
Summary: Google released Chrome security updates on Monday for two V8 type confusion flaws, including CVE-2025-13223 (CVSS 8.8), which Google acknowledged has an exploit in the wild and which can allow a remote attacker to potentially exploit heap corruption via a crafted HTML page. Clément Lecigne of Google's Threat Analysis Group is credited with reporting the flaw on November 12, 2025, and the patch also covers CVE-2025-13224, a second V8 type confusion bug flagged by Google's AI agent Big Sleep.
Key Takeaway: This is the seventh Chrome zero-day of the year and the third actively exploited V8 type confusion bug, and Google has disclosed nothing about who is behind the attacks or who was targeted - so the only known mitigation is reaching version 142.0.7444.175/.176, with Chromium-based browsers like Edge, Brave, Opera, and Vivaldi left waiting on their own fixes.