# Microsoft patches six flaws including V8 RCE

Published: 2026-06-09 · Severity: high
Canonical: https://vorant.io/reports/c75849cf-0a0f-475a-8de4-10526309d787/microsoft-patches-six-flaws-including-v8-rce

> Microsoft's August 2025 update addresses six vulnerabilities across Windows, Edge, and Azure products, including a critical V8 out-of-bounds write allowing remote code execution.

Microsoft released security updates on August 22, 2025, addressing multiple vulnerabilities across its product portfolio. The most severe flaw is CVE-2025-9132, an out-of-bounds write vulnerability in the V8 JavaScript engine used by Chromium-based Edge, which allows remote code execution through a malicious HTML page. A second critical vulnerability, CVE-2025-55231, affects Windows Storage and involves a race condition that permits unauthorized remote code execution.

Additional vulnerabilities include privilege escalation flaws in Azure Databricks (CVE-2025-53763) and Microsoft PC Manager (CVE-2025-53795), a certificate spoofing issue in Windows Certificates (CVE-2025-55229), and a local privilege escalation in the Windows MBT Transport driver (CVE-2025-55230). The advisory covers an extensive range of affected systems including Windows 10, Windows 11, Windows Server editions from 2008 through 2025, Microsoft Edge, and various Azure services.

No active exploitation has been reported for any of these vulnerabilities. Successful exploitation of the remote code execution flaws could allow attackers to gain privileges equivalent to the logged-on user, potentially enabling them to install programs, manipulate data, or create new accounts. MS-ISAC recommends immediate patching after appropriate testing, along with implementing vulnerability management processes and network segmentation controls.

## Mentioned in this report

- Vulnerabilities: CVE-2025-53763, CVE-2025-53795, CVE-2025-55229, CVE-2025-55230, CVE-2025-55231, CVE-2025-9132

## Detection guidance (public sample)

### Suspicious Child Process Spawned from Microsoft Edge (Possible Browser Exploitation)

ATT&CK: T1203

Detects command/script interpreters or LOLBins spawned directly from Microsoft Edge processes, consistent with post-exploitation activity following a browser RCE such as the V8 out-of-bounds write flaw (CVE-2025-9132) triggered via a malicious HTML page. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Suspicious Child Process Spawned from Microsoft Edge (Possible Browser Exploitation)
id: 31f819cc-3b27-5123-84a0-e2eb69888453
status: experimental
description: 'Detects command/script interpreters or living-off-the-land binaries
  launched as a direct child process of Microsoft Edge (msedge.exe or its content/renderer
  processes). Browser RCE vulnerabilities, such as the V8 engine out-of-bounds write
  flaw (CVE-2025-9132), can allow an attacker to achieve code execution in the context
  of the logged-on user after the victim opens a malicious HTML page. Legitimate Edge
  operation does not spawn shells or scripting engines as direct children.

  '
references:
- https://msrc.microsoft.com/update-guide (August 2025 Patch Tuesday)
author: Vorant
tags:
- attack.t1203
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
    - \msedge.exe
  selection_child:
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
  filter_updater:
    CommandLine|contains:
    - MicrosoftEdgeUpdate
    - \Update\
  condition: selection_parent and selection_child and not filter_updater
falsepositives:
- Edge browser update or crash-reporting helper processes that legitimately spawn
  utility binaries
- Enterprise software deployment tools that inject automation scripts through Edge
  for testing
level: high
```

### Browser Launched with Direct URL Argument from Non-Standard Parent (Possible Malicious Link Execution)

ATT&CK: T1204.001

Detects Microsoft Edge being launched with a URL command-line argument by an unusual parent process (e.g., email client, chat app, or document reader), indicating a user clicked a malicious link that could lead to exploitation of a browser vulnerability. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Browser Launched with Direct URL Argument from Non-Standard Parent (Possible
  Malicious Link Execution)
id: 2dba7039-24c4-5e64-9bee-b4e3212c3512
status: experimental
description: 'Detects msedge.exe launched with a URL as a command-line argument where
  the parent process is an email client, messaging application, or document viewer
  rather than the shell or another browser process. This pattern is consistent with
  a user clicking a malicious link (T1204.001) that could deliver a page exploiting
  a browser vulnerability such as the V8 engine flaw (CVE-2025-9132).

  '
references:
- https://msrc.microsoft.com/update-guide (August 2025 Patch Tuesday)
author: Vorant
tags:
- attack.t1204.001
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection_child:
    Image|endswith: \msedge.exe
    CommandLine|contains:
    - http://
    - https://
  selection_parent_suspicious:
    ParentImage|endswith:
    - \OUTLOOK.EXE
    - \Teams.exe
    - \slack.exe
    - \AcroRd32.exe
    - \WINWORD.EXE
    - \thunderbird.exe
  condition: selection_child and selection_parent_suspicious
falsepositives:
- Legitimate business use of hyperlinks embedded in email, chat messages, or documents
  opening in Edge
- Automated link-preview or safe-link rewriting features in enterprise email security
  products
level: low
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-microsoft-products-could-allow-for-remote-code-execution_2025-076

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/c75849cf-0a0f-475a-8de4-10526309d787/microsoft-patches-six-flaws-including-v8-rce.
Full IOC sets, deployable detections, the entity graph, TAXII 2.1 feed and real-time alerts: https://vorant.io/signup