chromium-browser: Race in v8
cve CVE-2025-13721 2 sources, 2 claims · Watch
What it is to other things
| affects | apple/macos NVD |
| affects | google/chrome NVD |
| affects | linux/linux_kernel NVD |
| affects | microsoft/windows NVD |
| made_by | apple NVD |
| made_by | google NVD |
| made_by | linux NVD |
| made_by | microsoft NVD |
What each source says
| Property | Source | Said | Means here | ||||
|---|---|---|---|---|---|---|---|
| Cvss cvss conflict | NVD | 7.5receipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "143.0.7499.41",
"status": "affected",
"version": "143.0.7499.41",
"versionType": "custom"
}
]
}
],
"source": "chrome-cve-admin@google.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28874374-C1B5-4638-BCCD-0AC4F1DAA6EC",
"versionEndExcluding": "143.0.7499.40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "459C09D2-0D67-4FF1-950B-0FB611D6FFD6",
"versionEndExcluding": "143.0.7499.41",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)"
},
{
"lang": "es",
"value": "Una condición de carrera en v8 en Google Chrome Versiones anteriores a 143.0.7499.41 permitió a un atacante remoto potencialmente explotar la corrupción de pila a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Media)"
}
],
"id": "CVE-2025-13721",
"lastModified": "2026-09-25T23:10:00.463",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-13721",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-03T04:55:46.676425Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-12-02T19:15:48.990",
"references": [
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html"
},
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Issue Tracking",
"Permissions Required"
],
"url": "https://issues.chromium.org/issues/355120682"
}
],
"sourceIdentifier": "chrome-cve-admin@google.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "chrome-cve-admin@google.com",
"type": "Secondary"
}
]
}
} | — | ||||
| Cvss cvss conflict | Red Hat | 6.5receipt
What the source handed over{
"CVE": "CVE-2025-13721",
"CWE": "CWE-366",
"advisories": [],
"affected_packages": [],
"bugzilla": "2418465",
"bugzilla_description": "chromium-browser: Race in v8",
"cvss3_score": "6.5",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cvss_score": null,
"cvss_scoring_vector": null,
"package_state": null,
"public_date": "2025-12-02T19:00:17Z",
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-13721.json",
"severity": "moderate"
} | — | ||||
| Cwe cwe | Red Hat | CWE-366receipt
What the source handed over{
"CVE": "CVE-2025-13721",
"CWE": "CWE-366",
"advisories": [],
"affected_packages": [],
"bugzilla": "2418465",
"bugzilla_description": "chromium-browser: Race in v8",
"cvss3_score": "6.5",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cvss_score": null,
"cvss_scoring_vector": null,
"package_state": null,
"public_date": "2025-12-02T19:00:17Z",
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-13721.json",
"severity": "moderate"
} | — | ||||
| Product product | NVD | Chromereceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "143.0.7499.41",
"status": "affected",
"version": "143.0.7499.41",
"versionType": "custom"
}
]
}
],
"source": "chrome-cve-admin@google.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28874374-C1B5-4638-BCCD-0AC4F1DAA6EC",
"versionEndExcluding": "143.0.7499.40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "459C09D2-0D67-4FF1-950B-0FB611D6FFD6",
"versionEndExcluding": "143.0.7499.41",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)"
},
{
"lang": "es",
"value": "Una condición de carrera en v8 en Google Chrome Versiones anteriores a 143.0.7499.41 permitió a un atacante remoto potencialmente explotar la corrupción de pila a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Media)"
}
],
"id": "CVE-2025-13721",
"lastModified": "2026-09-25T23:10:00.463",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-13721",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-03T04:55:46.676425Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-12-02T19:15:48.990",
"references": [
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html"
},
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Issue Tracking",
"Permissions Required"
],
"url": "https://issues.chromium.org/issues/355120682"
}
],
"sourceIdentifier": "chrome-cve-admin@google.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "chrome-cve-admin@google.com",
"type": "Secondary"
}
]
}
} | — | ||||
| Severity severity | Red Hat | moderate A flaw that is harder to exploit, or whose impact is limited. receipt
What the source handed over{
"CVE": "CVE-2025-13721",
"CWE": "CWE-366",
"advisories": [],
"affected_packages": [],
"bugzilla": "2418465",
"bugzilla_description": "chromium-browser: Race in v8",
"cvss3_score": "6.5",
"cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"cvss_score": null,
"cvss_scoring_vector": null,
"package_state": null,
"public_date": "2025-12-02T19:00:17Z",
"resource_url": "https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2025-13721.json",
"severity": "moderate"
} | medium | ||||
| Status status | NVD | Analyzedreceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "143.0.7499.41",
"status": "affected",
"version": "143.0.7499.41",
"versionType": "custom"
}
]
}
],
"source": "chrome-cve-admin@google.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28874374-C1B5-4638-BCCD-0AC4F1DAA6EC",
"versionEndExcluding": "143.0.7499.40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "459C09D2-0D67-4FF1-950B-0FB611D6FFD6",
"versionEndExcluding": "143.0.7499.41",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)"
},
{
"lang": "es",
"value": "Una condición de carrera en v8 en Google Chrome Versiones anteriores a 143.0.7499.41 permitió a un atacante remoto potencialmente explotar la corrupción de pila a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Media)"
}
],
"id": "CVE-2025-13721",
"lastModified": "2026-09-25T23:10:00.463",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-13721",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-03T04:55:46.676425Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-12-02T19:15:48.990",
"references": [
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html"
},
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Issue Tracking",
"Permissions Required"
],
"url": "https://issues.chromium.org/issues/355120682"
}
],
"sourceIdentifier": "chrome-cve-admin@google.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "chrome-cve-admin@google.com",
"type": "Secondary"
}
]
}
} | — | ||||
| Vendor vendor | NVD | Googlereceipt
What the source handed over{
"cve": {
"affected": [
{
"affectedData": [
{
"product": "Chrome",
"vendor": "Google",
"versions": [
{
"lessThan": "143.0.7499.41",
"status": "affected",
"version": "143.0.7499.41",
"versionType": "custom"
}
]
}
],
"source": "chrome-cve-admin@google.com"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "28874374-C1B5-4638-BCCD-0AC4F1DAA6EC",
"versionEndExcluding": "143.0.7499.40",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
"matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
"vulnerable": false
},
{
"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
"matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
"matchCriteriaId": "459C09D2-0D67-4FF1-950B-0FB611D6FFD6",
"versionEndExcluding": "143.0.7499.41",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
},
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
"matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
"vulnerable": false
}
],
"negate": false,
"operator": "OR"
}
],
"operator": "AND"
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)"
},
{
"lang": "es",
"value": "Una condición de carrera en v8 en Google Chrome Versiones anteriores a 143.0.7499.41 permitió a un atacante remoto potencialmente explotar la corrupción de pila a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: Media)"
}
],
"id": "CVE-2025-13721",
"lastModified": "2026-09-25T23:10:00.463",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "HIGH",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"exploitabilityScore": 1.6,
"impactScore": 5.9,
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2025-13721",
"options": [
{
"exploitation": "none"
},
{
"automatable": "no"
},
{
"technicalImpact": "total"
}
],
"role": "CISA Coordinator",
"timestamp": "2025-12-03T04:55:46.676425Z",
"version": "2.0.3"
}
}
]
},
"published": "2025-12-02T19:15:48.990",
"references": [
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html"
},
{
"source": "chrome-cve-admin@google.com",
"tags": [
"Issue Tracking",
"Permissions Required"
],
"url": "https://issues.chromium.org/issues/355120682"
}
],
"sourceIdentifier": "chrome-cve-admin@google.com",
"vulnStatus": "Analyzed",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-362"
}
],
"source": "chrome-cve-admin@google.com",
"type": "Secondary"
}
]
}
} | — |
vulnerability
| chromium-browser: Race in v8 zetlyn/cve-redhat · 2025-12-02 | cvss 6.5 cwe CWE-366 severity moderate | source |
| Race in v8 in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) zetlyn/cve-nvd · 2025-12-02 | cvss 7.5 product Chrome status Analyzed vendor Google | source |