EUVD-2025-17086Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
3DescriptionCVE.org
Wasm exception capture vulnerability in the arkweb v8 module Impact: Successful exploitation of this vulnerability may cause the failure to capture specific Wasm exception types.
AnalysisAI
WebAssembly exception handling vulnerability in the arkweb v8 module that prevents proper capture of specific Wasm exception types, potentially allowing attackers to bypass security controls or trigger unexpected application behavior. The vulnerability affects arkweb's V8 integration layer and requires network access but high attack complexity to exploit. While the CVSS score of 8.1 indicates high severity with potential impacts to confidentiality, integrity, and availability, real-world exploitability depends on whether active exploitation or proof-of-concept code exists.
Technical ContextAI
This vulnerability exists in arkweb's V8 (Chrome's JavaScript/WebAssembly engine) module, specifically in the exception handling mechanisms for WebAssembly. CWE-1068 (Initialization with Hard-Coded Network Resource Configuration Data) suggests the root cause involves improper initialization or configuration of Wasm exception capture handlers, potentially through hardcoded values that fail to accommodate all exception type scenarios. The arkweb project is a Chromium-based embedded browser engine, making this relevant to any system embedding arkweb for WebAssembly execution. The vulnerability manifests when the V8 engine attempts to capture and handle exceptions thrown by Wasm code—certain exception types may bypass the capture mechanism entirely, leading to unhandled exceptions that could crash the application or expose sensitive execution context.
RemediationAI
- Update arkweb to the patched version once released by the arkweb/Chromium project (monitor official release notes). 2. If immediate patching is unavailable, disable WebAssembly execution in arkweb or restrict Wasm code to trusted sources only. 3. Implement strict Content Security Policy (CSP) restrictions preventing untrusted Wasm module loading. 4. Run arkweb in a sandboxed environment with restricted permissions to limit blast radius if exception handling bypass occurs. 5. Monitor application logs for uncaught Wasm exceptions or unexpected crashes correlating with Wasm execution. 6. For embedded implementations, review V8 initialization code to ensure exception handlers are properly registered for all Wasm exception types. Patch availability and specific version numbers require consultation with official arkweb/Chromium security advisories.
Permission verification vulnerability in the wpa_supplicant module Impact: Successful exploitation of this vulnerability
Permission management vulnerability in the PMS module. Rated critical severity (CVSS 9.8), this vulnerability is remotel
Vulnerability of access permissions not being strictly verified in the APPWidget module.Successful exploitation of this
Vulnerability of permissions not being strictly verified in the window management module.Successful exploitation of this
API permission management vulnerability in the Fwk-Display module.Successful exploitation of this vulnerability may caus
Vulnerability of defects introduced in the design process in the HiviewTunner module. Rated critical severity (CVSS 9.8)
The DP module has a service hijacking vulnerability.Successful exploitation of this vulnerability may affect some Super
Vulnerability of out-of-bounds parameter read/write in the Wi-Fi module. Rated critical severity (CVSS 9.8), this vulner
Vulnerability of commands from the modem being intercepted in the atcmdserver module. Rated critical severity (CVSS 9.8)
Some smartphones have configuration issues. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitab
Some smartphones have the out-of-bounds write vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is r
Some smartphones have the out-of-bounds write vulnerability.Successful exploitation of this vulnerability may cause syst
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today