Chrome type confusion flaws exploited in wild
Google Chrome patched two type confusion vulnerabilities in V8, with CVE-2025-13223 actively exploited, enabling arbitrary code execution via drive-by attacks.
Multiple vulnerabilities have been discovered in Google Chrome's V8 JavaScript engine, the most critical being type confusion flaws tracked as CVE-2025-13223 and CVE-2025-13224. Google has confirmed that CVE-2025-13223 is being actively exploited in the wild. Successful exploitation allows attackers to achieve arbitrary code execution in the context of the logged-on user through drive-by compromise techniques, where victims are targeted simply by visiting a malicious or compromised website.
The impact of these vulnerabilities depends on the privilege level of the compromised user account. Attackers exploiting these flaws could install programs, view or modify data, delete information, or create new accounts with full user rights. Users operating with administrative privileges face greater risk than those with restricted access rights.
The vulnerabilities affect Chrome versions prior to 142.0.7444.175/.176 for Windows and macOS, and prior to 142.0.7444.175 for Linux. Organizations are advised to apply the available patches immediately after appropriate testing, implement application sandboxing and exploit protection features, enforce the principle of least privilege, and maintain robust URL filtering and user awareness programs to mitigate drive-by compromise risks.
Mentioned in this report
Detection guidance
Suspicious Child Process Spawned from Google Chrome (Possible Browser Exploitation)
Detects Chrome (or its renderer/GPU helper processes) spawning shell, scripting, or LOLBin interpreters, a common post-exploitation indicator following successful browser RCE via drive-by compromise (e.g. V8 type confusion CVEs). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Suspicious Child Process Spawned from Google Chrome
id: f8ec957c-7046-5aca-b2f6-bc462b19a959
status: experimental
description: 'Detects command interpreters, scripting engines, or LOLBins being spawned
directly from chrome.exe or its renderer/GPU process. This behaviour is atypical
for normal browsing and consistent with post-exploitation activity following a browser
memory-corruption exploit (e.g. V8 type confusion vulnerabilities such as CVE-2025-13223)
delivered via drive-by compromise.
'
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.T1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
filter_updater:
CommandLine|contains:
- chrome_installer
- \Update\GoogleUpdate.exe
- --type=crashpad-handler
condition: selection and not filter_updater
falsepositives:
- Chrome auto-update or crash-reporting helper processes launching legitimate updater
binaries
- Enterprise browser management tools that shell out from chrome.exe for policy enforcement
level: high
Chrome Renderer or GPU Process Crash Followed by Unexpected Process Creation
Flags process creation events where a process is spawned by Chrome's sandboxed renderer/GPU process (chrome.exe with --type=renderer/gpu-process) rather than the main browser process, indicating a possible sandbox escape after exploitation of a V8 memory-corruption vulnerability during drive-by compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Process Creation from Chrome Sandboxed Renderer or GPU Process
id: 21b68c63-e15c-5573-bd16-ab9636e0daf1
status: experimental
description: 'Detects new process creation where the parent command line indicates
a Chrome sandboxed renderer or GPU process (--type=renderer or --type=gpu-process)
rather than the main browser process. Under normal operation these sandboxed processes
should not spawn arbitrary child processes; doing so is a strong indicator of a
sandbox escape or successful in-the-wild exploitation of a V8 type confusion vulnerability
delivered through a malicious web page (drive-by compromise).
'
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.T1055
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
ParentCommandLine|contains:
- --type=renderer
- --type=gpu-process
- --type=utility
exclude_known:
Image|endswith:
- \chrome.exe
- \chrome_crashpad_handler.exe
condition: selection and not exclude_known
falsepositives:
- Legitimate Chrome extension or utility processes that spawn helper binaries for
printing, PDF rendering, or media codecs
- Enterprise endpoint agents that hook into Chrome sandbox processes for monitoring
level: medium
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-109
This is the public brief
Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.
Start free