Out-of-bounds write in Google Chromium - CVE-2025-5419

Vulnerability identifier: #VU110079

CSH Severity: Critical

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5419

CWE-ID: CWE-787

Exploitation vector: Remote access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a remote attacker to compromise vulnerable system.

The vulnerability exists due to a boundary error in the V8 engine. A remote attacker can trick the victim into visiting a specially crafted website, trigger an out-of-bounds write and execute arbitrary code on the target system.

Note, the vulnerability is being actively exploited in the wild.

Google Chromium
Microsoft Edge
Google Chrome
Prisma Access Browser
Gentoo Linux
Debian Linux
Fedora
Chrome OS
www-client/vivaldi
www-client/opera
chromium
chromium (Debian package)
www-client/microsoft-edge
www-client/chromium
www-client/google-chrome

Install update from vendor's repository.

Google Chromium - update to 137.0.7151.68
Microsoft Edge - update to 137.0.3296.62
Google Chrome - update to 137.0.7151.68
www-client/vivaldi - update to 7.5.3735.44
www-client/opera - update to 122.0.5643.17
Chrome OS - update to 132.0.6834.225
chromium - addressed in versions 137.0.7151.68-1.el9, 137.0.7151.68-1.el10_1, 137.0.7151.68-1.fc41, 137.0.7151.68-1.fc42
chromium (Debian package) - update to 137.0.7151.68-1~deb12u1
Prisma Access Browser - update to 137.16.2.69
www-client/microsoft-edge - update to 138.0.3351.65
www-client/chromium - update to 138.0.7204.92
www-client/google-chrome - update to 138.0.7204.92

• Exploit #12412 - CVE-2025-5419 (?️ Analyze CVE-2025-5419 to exploit an uninitialized read vulnerability in V8 for arbitrary read/write access within the sandbox environment.) (February 13, 2026)
• Exploit #12373 - CVE-2025-5419 (February 6, 2026)
• Exploit #11906 - CVE-2025-5419 (August 30, 2025)
• Exploit #11860 - CVE-2025-5419 (August 22, 2025)
• Exploit #11745 - chrome_v8_cve_checker (July 3, 2025)

• https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html
• https://crbug.com/420636529

• Multiple vulnerabilities in Google Chrome
• Multiple vulnerabilities in Microsoft Edge
• Debian update for chromium
• Fedora 42 update for chromium
• Fedora EPEL 10.1 update for chromium
• Fedora 41 update for chromium
• Fedora EPEL 9 update for chromium
• Multiple vulnerabilities in Google ChromeOS LTS
• Multiple vulnerabilities in Prisma Access Browser
• Gentoo update for Chromium, Google Chrome, Microsoft Edge, Opera, Vivaldi