CVE-2025-9864

Published Sep 3, 2025

Last updated a month ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-9864 is a use-after-free vulnerability affecting the V8 JavaScript engine in Google Chrome versions prior to 140.0.7339.80. This flaw can be triggered by a crafted HTML page, potentially leading to heap corruption. A remote attacker could exploit this vulnerability to execute arbitrary code within the Chrome renderer process. The vulnerability exists because the V8 engine reuses or references memory after it has been freed. After the memory is freed, it can be allocated again and saved in another pointer. Operations using the original pointer then become invalid because the memory belongs to the code that operates on the new pointer.

Description: Use after free in V8 in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Source: chrome-cve-admin@google.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

chrome-cve-admin@google.com: CWE-416

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 13

References