Attackers are using this November 17, 2025 Critical severity

Chrome flaw used in attacks (JavaScript engine)

A flaw in Chrome’s JavaScript engine (V8), “Type Confusion in V8”, lets a booby-trapped web page run code. Google says an exploit exists in the wild. Fixed in Chrome 142.0.7444.176.

On a Mac

Chrome and other Chromium browsers, and apps built on Electron or Chromium. Each app carries its own copy, so it stays exposed until that app updates, even when Chrome is current.

The fix

• Chrome 142.0.7444.176
• Electron 37.10.1, 38.7.1, 39.2.4, 40.0.0, 41.0.0, 42.0.0, 43.0.0, 44.0.0 and 45.0.0

Attacks

In CISA’s catalog of exploited flaws since November 19, 2025.

CVE

CVE-2025-13223

Sources

• chromereleases.googleblog.com
• cisa.gov

From the Briefing, updated 19 minutes ago.