What is the CVSS score of CVE-2025-5959?

CVE-2025-5959 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Chrome are affected by CVE-2025-5959?

A high-severity vulnerability in Google Chrome (CVE-2025-5959) allows attackers to execute malicious code within the browser sandbox by tricking users into visiting crafted websites.. A patch is available.

How to fix or mitigate CVE-2025-5959?

Within 24 hours: Issue security alert to all users advising against visiting untrusted websites and restricting Chrome usage to essential business functions only. Within 7 days: Deploy web filtering/proxy rules to block known malicious domains, implement browser isolation technology for high-risk users, and consider enforcing alternative browsers for sensitive tasks. Within 30 days: Monitor Google Chrome release notes for patch availability and prepare immediate deployment procedures; conduct user awareness training on social engineering tactics that may exploit this vulnerability.

Chrome CVE-2025-5959

EUVD-2025-18071 HIGH

Access of Resource Using Incompatible Type (Type Confusion) (CWE-843)

2025-06-11 chrome-cve-admin@google.com

RCE Memory Corruption Google Chrome Suse

8.8

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

8.8 HIGH

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

SUSE

HIGH

qualitative

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 21:09 euvd

EUVD-2025-18071

Analysis Generated

Mar 14, 2026 - 21:09 vuln.today

CVE Published

Jun 11, 2025 - 01:15 nvd

HIGH 8.8

DescriptionCVE.org

Type Confusion in V8 in Google Chrome prior to 137.0.7151.103 allowed a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. (Chromium security severity: High)

AnalysisAI

Type confusion vulnerability in Google Chrome's V8 JavaScript engine that enables remote code execution within the Chrome sandbox prior to version 137.0.7151.103. An attacker can exploit this via a crafted HTML page by tricking a user into visiting a malicious website, achieving arbitrary code execution with high severity impact (CVSS 8.8). The vulnerability's network-based attack vector, low complexity, and requirement only for user interaction make it a practical exploitation target.

Technical ContextAI

This vulnerability exists in V8, Google Chrome's JavaScript engine, and is classified as a type confusion vulnerability (CWE-843). Type confusion occurs when the JavaScript engine incorrectly identifies or handles the type of an object or value, allowing attackers to bypass type safety mechanisms. The root cause is a flaw in V8's type system handling that fails to properly validate type information during object manipulation or function calls. CPE affected: cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (versions prior to 137.0.7151.103). This affects the core V8 JIT compiler or interpreter responsible for JavaScript execution, potentially in object property access, array element handling, or function call dispatch mechanisms.

RemediationAI

primary_action: Update Google Chrome to version 137.0.7151.103 or later; method: Automatic updates (Chrome automatically downloads and installs security updates on restart) or manual update via Menu > Help > About Google Chrome
primary_action: Update Chromium-based browsers; method: Update Edge, Brave, Opera, and other Chromium-based browsers to their latest versions released after Chrome 137.0.7151.103
temporary_mitigation: Avoid visiting untrusted websites until patched; disable JavaScript for untrusted content (limits usability; not recommended as primary mitigation)
temporary_mitigation: Monitor browser update status and force restart after updates to ensure patch application
reference: Google Chrome Release Notes (https://chromereleases.googleblog.com/) for v137.0.7151.103 and later security updates

More in Chrome

View all

CVE-2015-5122 CRITICAL Emergency POC

9.8 Jul 14

Use-after-free vulnerability in the DisplayObject class in the ActionScript 3 (AS3) implementation in Adobe Flash Player

CVE-2016-5198 HIGH Act Now POC

8.8 Jan 19

V8 in Google Chrome prior to 54.0.2840.90 for Linux, and 54.0.2840.85 for Android, and 54.0.2840.87 for Windows and Mac

CVE-2017-5070 HIGH Act Now POC

8.8 Oct 27

Type confusion in V8 in Google Chrome prior to 59.0.3071.86 for Linux, Windows, and Mac, and 59.0.3071.92 for Android, a

CVE-2016-1646 HIGH Act Now POC

8.8 Mar 29

The Array.prototype.concat implementation in builtins.cc in Google V8, as used in Google Chrome before 49.0.2623.108, do

CVE-2013-0758 CRITICAL Emergency POC

9.3 Jan 13

Mozilla Firefox before 18.0, Firefox ESR 10.x before 10.0.12 and 17.x before 17.0.2, Thunderbird before 17.0.2, Thunderb

CVE-2017-5030 HIGH Act Now POC

8.8 Apr 24

Incorrect handling of complex species in V8 in Google Chrome prior to 57.0.2987.98 for Linux, Windows, and Mac and 57.0.

CVE-2012-3993 CRITICAL Emergency POC

9.3 Oct 10

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 16.0, Firefox ESR 10.x before 10.0.8, Thunderbi

CVE-2017-3823 HIGH Act Now POC

8.8 Feb 01

An issue was discovered in the Cisco WebEx Extension before 1.0.7 on Google Chrome, the ActiveTouch General Plugin Conta

CVE-2014-8636 HIGH Act Now POC

7.5 Jan 14

The XrayWrapper implementation in Mozilla Firefox before 35.0 and SeaMonkey before 2.32 does not properly interact with

CVE-2013-0757 CRITICAL Emergency POC

9.3 Jan 13

The Chrome Object Wrapper (COW) implementation in Mozilla Firefox before 18.0, Firefox ESR 17.x before 17.0.2, Thunderbi

CVE-2014-1510 CRITICAL Emergency POC

9.8 Mar 19

The Web IDL implementation in Mozilla Firefox before 28.0, Firefox ESR 24.x before 24.4, Thunderbird before 24.4, and Se

CVE-2015-5123 CRITICAL Emergency

9.8 Jul 14

Use-after-free vulnerability in the BitmapData class in the ActionScript 3 (AS3) implementation in Adobe Flash Player 13

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

View all

CVE-2011-0611 HIGH POC

8.8

CVE-2012-0507 CRITICAL POC

9.8

CVE-2017-8291 HIGH POC

7.8

CVE-2016-7201 HIGH POC

8.8

CVE-2017-0037 HIGH POC

8.1

CVE-2017-5070 HIGH POC

8.8

CVE-2025-30397 HIGH POC

7.5

CVE-2016-0985 HIGH POC

8.8

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

Vendor StatusVendor

Debian

chromium

Release	Status	Fixed Version	Urgency
bullseye (security), bullseye	vulnerable	120.0.6099.224-1~deb11u1	-
bookworm	fixed	137.0.7151.103-1~deb12u1	-
bookworm (security)	fixed	146.0.7680.71-1~deb12u1	-
trixie	fixed	145.0.7632.159-1~deb13u1	-
trixie (security)	fixed	146.0.7680.71-1~deb13u1	-
forky	fixed	146.0.7680.71-1	-
sid	fixed	146.0.7680.80-1	-
bullseye	fixed	(unfixed)	end-of-life
(unstable)	fixed	137.0.7151.103-1	-

DSA-5942-1

SUSE

Severity: High

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2025-5959 vulnerability details – vuln.today

Back

Chrome CVE-2025-5959

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Chrome

Same weakness CWE-843 – Access of Resource Using Incompatible Type (Type Confusion)

Same technique RCE

Vendor StatusVendor

Debian

SUSE

Share

External POC / Exploit Code