CVE-2025-10891

Published Sep 24, 2025

Last updated 8 months ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-10891 is an integer overflow vulnerability found in the V8 JavaScript engine, which is a core component of Google Chrome and other Chromium-based web browsers. This flaw occurs when arithmetic operations on user-provided input surpass the maximum value an integer type can hold, leading to calculations that "wrap around" and produce incorrect values. This vulnerability can result in heap corruption and potentially allow a remote attacker to execute arbitrary code by enticing a user to visit a specially crafted HTML page. The issue was addressed in Google Chrome version 140.0.7339.207.

Description: Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Source: chrome-cve-admin@google.com
NVD status: Analyzed
Products: chrome

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

chrome-cve-admin@google.com: CWE-472

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "3D069E2A-50D9-4C05-9331-42D8534136B2",
            "versionEndExcluding": "140.0.7339.207",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      },
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1",
            "vulnerable": false
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA",
            "vulnerable": false
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.