# Chrome type confusion flaws exploited in wild

Published: 2026-06-09 · Severity: critical
Canonical: https://vorant.io/reports/96b7d358-aa12-4748-9750-c78454af28be/chrome-type-confusion-flaws-exploited-in-wild

> Google Chrome patched two type confusion vulnerabilities in V8, with CVE-2025-13223 actively exploited, enabling arbitrary code execution via drive-by attacks.

Multiple vulnerabilities have been discovered in Google Chrome's V8 JavaScript engine, the most critical being type confusion flaws tracked as CVE-2025-13223 and CVE-2025-13224. Google has confirmed that CVE-2025-13223 is being actively exploited in the wild. Successful exploitation allows attackers to achieve arbitrary code execution in the context of the logged-on user through drive-by compromise techniques, where victims are targeted simply by visiting a malicious or compromised website.

The impact of these vulnerabilities depends on the privilege level of the compromised user account. Attackers exploiting these flaws could install programs, view or modify data, delete information, or create new accounts with full user rights. Users operating with administrative privileges face greater risk than those with restricted access rights.

The vulnerabilities affect Chrome versions prior to 142.0.7444.175/.176 for Windows and macOS, and prior to 142.0.7444.175 for Linux. Organizations are advised to apply the available patches immediately after appropriate testing, implement application sandboxing and exploit protection features, enforce the principle of least privilege, and maintain robust URL filtering and user awareness programs to mitigate drive-by compromise risks.

## Mentioned in this report

- Vulnerabilities: CVE-2025-13223 (KEV), CVE-2025-13224

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Google Chrome (Possible Browser Exploitation)

ATT&CK: T1189

Detects Chrome (or its renderer/GPU helper processes) spawning shell, scripting, or LOLBin interpreters, a common post-exploitation indicator following successful browser RCE via drive-by compromise (e.g. V8 type confusion CVEs). Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from Google Chrome
id: f8ec957c-7046-5aca-b2f6-bc462b19a959
status: experimental
description: 'Detects command interpreters, scripting engines, or LOLBins being spawned
  directly from chrome.exe or its renderer/GPU process. This behaviour is atypical
  for normal browsing and consistent with post-exploitation activity following a browser
  memory-corruption exploit (e.g. V8 type confusion vulnerabilities such as CVE-2025-13223)
  delivered via drive-by compromise.

  '
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.T1059
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_updater:
    CommandLine|contains:
    - chrome_installer
    - \Update\GoogleUpdate.exe
    - --type=crashpad-handler
  condition: selection and not filter_updater
falsepositives:
- Chrome auto-update or crash-reporting helper processes launching legitimate updater
  binaries
- Enterprise browser management tools that shell out from chrome.exe for policy enforcement
level: high
```

### Chrome Renderer or GPU Process Crash Followed by Unexpected Process Creation

ATT&CK: T1189

Flags process creation events where a process is spawned by Chrome's sandboxed renderer/GPU process (chrome.exe with --type=renderer/gpu-process) rather than the main browser process, indicating a possible sandbox escape after exploitation of a V8 memory-corruption vulnerability during drive-by compromise. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Process Creation from Chrome Sandboxed Renderer or GPU Process
id: 21b68c63-e15c-5573-bd16-ab9636e0daf1
status: experimental
description: 'Detects new process creation where the parent command line indicates
  a Chrome sandboxed renderer or GPU process (--type=renderer or --type=gpu-process)
  rather than the main browser process. Under normal operation these sandboxed processes
  should not spawn arbitrary child processes; doing so is a strong indicator of a
  sandbox escape or successful in-the-wild exploitation of a V8 type confusion vulnerability
  delivered through a malicious web page (drive-by compromise).

  '
references:
- https://chromereleases.googleblog.com/
author: Vorant
tags:
- attack.T1189
- attack.T1055
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    ParentCommandLine|contains:
    - --type=renderer
    - --type=gpu-process
    - --type=utility
  exclude_known:
    Image|endswith:
    - \chrome.exe
    - \chrome_crashpad_handler.exe
  condition: selection and not exclude_known
falsepositives:
- Legitimate Chrome extension or utility processes that spawn helper binaries for
  printing, PDF rendering, or media codecs
- Enterprise endpoint agents that hook into Chrome sandbox processes for monitoring
level: medium
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-109

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/96b7d358-aa12-4748-9750-c78454af28be/chrome-type-confusion-flaws-exploited-in-wild.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup