CVE-2025-9478

Published Aug 26, 2025

Last updated 9 days ago

Google Chrome

ANGLE

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-9478 is a use-after-free vulnerability found in the ANGLE component of Google Chrome. ANGLE translates OpenGL ES calls into native graphics API calls. The vulnerability affects Google Chrome versions prior to 139.0.7258.154 across Windows, Mac, and Linux platforms. The vulnerability can be triggered by a crafted HTML page, leading to heap corruption. By exploiting this vulnerability, an attacker could execute arbitrary code within the browser process, potentially compromising the user's browser session. Visiting a malicious website could trigger the exploit. Google has released security updates to address this vulnerability in Chrome version 139.0.7258.154/.155 for Windows and Mac, and 139.0.7258.154 for Linux.

Description: Use after free in ANGLE in Google Chrome prior to 139.0.7258.154 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Critical)
Source: chrome-cve-admin@google.com
NVD status: Analyzed
Products: chrome

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

chrome-cve-admin@google.com: CWE-416

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D227C26E-2612-4BEC-8C75-E1AF5E0861D1",
            "versionEndExcluding": "139.0.7258.154"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"
          },
          {
            "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.