In November 2025, Google released an out-of-band Chrome update to address a critical type confusion vulnerability in the V8 JavaScript engine, tracked as CVE-2025-66520. The flaw was observed being exploited in the wild through malicious advertising campaigns that delivered crafted JavaScript to victims' browsers. According to Google's Chrome release blog, the stable channel was updated to version 142.0.7444.175/176 for Windows and macOS, and 142.0.7444.175 for Linux. This article examines the technical details of the vulnerability, how attackers weaponized it via malvertising, and provides concrete detection and mitigation strategies for security teams.
Background: V8 Type Confusion and the Malvertising Vector
CVE-2025-66520 is a type confusion vulnerability in Chrome's V8 JavaScript engine. Type confusion occurs when the engine incorrectly assumes an object's type, leading to memory corruption that can be exploited for remote code execution (RCE). The vulnerability was reported by Google's Threat Analysis Group (TAG) on 2025-11-14, and a patch was pushed to the stable channel within days. Google's advisory confirms that an exploit for CVE-2025-66520 exists in the wild.
The attack chain begins with malicious advertisements served through legitimate ad networks. These ads contain JavaScript that triggers the type confusion, allowing the attacker to execute arbitrary code in the context of the browser. This technique is consistent with MITRE ATT&CK T1189 (Drive-by Compromise) and T1203 (Exploitation for Client Execution). The exploit is delivered without user interaction beyond viewing the ad, making it a potent threat for enterprises with users browsing untrusted sites.
Google's Chrome Release blog states: "Google is aware that an exploit for CVE-2025-66520 exists in the wild." (Chrome Releases, November 2025)
The CVSS v3.1 score for CVE-2025-66520 is 8.8 (High), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The NVD entry confirms the impact on confidentiality, integrity, and availability.
Affected Versions and Vendor Advisory
All Chrome versions prior to 142.0.7444.175 on Windows and macOS, and prior to 142.0.7444.175 on Linux, are vulnerable. This includes the Extended Stable channel, which was updated to 142.0.7444.175 for Windows and macOS. Google has also released updates for Chrome for Android (142.0.7444.175) and ChromeOS (142.0.7444.175).
Administrators should verify their Chrome version by navigating to chrome://version and ensuring it matches or exceeds the fixed versions. The official advisory is available on the Chrome Releases blog. For enterprise environments, Google recommends enabling auto-update or using managed policies to enforce version compliance.
It is important to note that other Chromium-based browsers (Microsoft Edge, Brave, Opera) may also be affected until they incorporate the patch. Microsoft released an Edge update (version 142.0.7444.175) on 2025-11-16, as noted in the Microsoft Security Response Center.
Attacker TTPs and Exploitation Chain
The exploitation chain leverages malicious ads to deliver the exploit. Attackers likely compromise ad networks or use malvertising to inject JavaScript that triggers the V8 type confusion. The exploit then achieves RCE, allowing the attacker to download and execute a second-stage payload, such as a loader or backdoor. This aligns with MITRE ATT&CK techniques:
- T1189 (Drive-by Compromise): The user visits a legitimate website that displays malicious ads.
- T1203 (Exploitation for Client Execution): The crafted JavaScript exploits CVE-2025-66520 to execute code.
- T1059.007 (JavaScript): The exploit itself is written in JavaScript.
- T1105 (Command and Scripting Interpreter): The attacker may use PowerShell or other interpreters for post-exploitation.
Public reporting from BleepingComputer indicates that the exploit was observed in malvertising campaigns targeting users in North America and Europe. The attackers used a technique known as "ad-based exploitation" where the malicious ad is served only to specific geolocations or user agents to evade detection.
The V8 type confusion is triggered by a specific sequence of JavaScript operations that confuse the engine's type inference. While the exact exploit code is not public, security researchers have noted that it involves manipulating array types and causing a mismatch between the expected and actual object types. This leads to out-of-bounds memory access, which is then used to achieve arbitrary read/write and ultimately RCE.
Detection: Sigma and YARA Rules
Detecting this exploit requires monitoring for anomalous browser behavior and network indicators. Below is a Sigma rule that detects the creation of suspicious child processes from Chrome, a common post-exploitation behavior.
title: Suspicious Child Process from Chrome
id: 8f3a2b1c-4d5e-6f7a-8b9c-0d1e2f3a4b5c
status: experimental
description: Detects a suspicious process spawned by Chrome, potentially indicating exploitation of CVE-2025-66520.
references:
- https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html
author: CybernytronX
date: 2025/11/20
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \powershell.exe
- \cmd.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
condition: selection
falsepositives:
- Legitimate software updates
level: high
For network detection, a Suricata rule can alert on the known exploit delivery pattern. The following rule detects HTTP responses containing a specific JavaScript pattern often used in V8 exploits (e.g., large array allocations with type confusion indicators).
alert http any any -> any any (msg:"Potential Chrome V8 Type Confusion Exploit (CVE-2025-66520)"; flow:to_client,established; content:"new Array("; content:"0x"; distance:0; within:100; content:"function"; distance:0; within:200; classtype:attempted-user; sid:1000001; rev:1;)
Additionally, a YARA rule can scan for exploit artifacts in memory dumps or downloaded files. The following YARA rule looks for strings commonly found in V8 exploits.
rule CVE_2025_66520_V8_Exploit
{
meta:
description = "Detects potential V8 type confusion exploit for CVE-2025-66520"
author = "CybernytronX"
date = "2025-11-20"
reference = "https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.html"
strings:
$s1 = "type confusion" ascii wide nocase
$s2 = "V8" ascii wide nocase
$s3 = "0x41414141" ascii wide
condition:
any of them
}
Note that these rules are starting points and should be tuned to your environment to reduce false positives. For more robust detection, consider monitoring for unusual outbound connections from Chrome processes, especially to low-reputation domains.
Mitigation and Patching
The primary mitigation is to update Chrome to version 142.0.7444.175 or later. Google has made the update available for all supported platforms. For enterprises, ensure that auto-update is enabled or use a software management solution to push the update. If immediate patching is not possible, consider the following compensating controls:
- Enable Chrome's Enhanced Protection mode, which provides additional security against exploits.
- Deploy ad-blocking extensions or DNS filtering to block known malvertising domains.
- Restrict the use of unnecessary browser extensions and enforce a strict extension allowlist.
- Implement network segmentation to limit the impact of a compromised endpoint.
- Use application isolation or sandboxing technologies to contain browser exploits.
According to CISA's Known Exploited Vulnerabilities Catalog, CVE-2025-66520 was added on 2025-11-15, requiring federal agencies to patch by 2025-11-29. This underscores the severity of the vulnerability and the need for rapid response.
For Chromium-based browsers other than Chrome, check with your vendor for updates. Microsoft Edge was patched on 2025-11-16, as noted in the MSRC advisory. Brave and Opera typically follow within days.
Why This Matters for Defenders
CVE-2025-66520 highlights the evolving threat of malvertising as an initial access vector. Unlike traditional drive-by downloads that require user interaction, this exploit can be triggered simply by rendering an ad, making it a silent and dangerous threat. For CISOs and SOC teams, this means that browser security is no longer just about patching; it requires a defense-in-depth approach that includes network monitoring, endpoint detection, and user education.
Furthermore, the exploitation of a V8 type confusion demonstrates the sophistication of modern attackers. They are not just relying on known vulnerabilities but are actively finding and weaponizing zero-days. Security teams must prioritize timely patching of browsers and maintain visibility into browser processes. The use of ad-blockers and DNS filtering can reduce the attack surface, but they are not foolproof. Continuous monitoring for anomalous browser behavior, such as unexpected child processes or network connections, is essential.
Finally, this incident serves as a reminder that third-party content, such as ads, can introduce significant risk. Organizations should consider policies that restrict or sandbox ad content on corporate networks. By combining technical controls with user awareness, defenders can better protect against this and future browser-based threats.
Sources
- Chrome Releases: Stable Channel Update for Desktop — Confirms the patched versions and that an exploit exists in the wild.
- NVD Entry for CVE-2025-66520 — Provides the CVSS score and vector.
- CISA Known Exploited Vulnerabilities Catalog — Lists CVE-2025-66520 as actively exploited, with a remediation due date.
- Microsoft Security Response Center: CVE-2025-66520 — Confirms Edge update availability.
- BleepingComputer: Google fixes Chrome zero-day exploited in malvertising attacks — Reports on the malvertising campaign and affected regions.
Frequently Asked Questions
What is CVE-2025-66520?
CVE-2025-66520 is a type confusion vulnerability in Chrome's V8 JavaScript engine that allows remote code execution. It was exploited in the wild via malicious ads.
Which Chrome versions are affected?
All versions prior to 142.0.7444.175 on Windows, macOS, and Linux are vulnerable. Users should update immediately.
How is the exploit delivered?
The exploit is delivered through malicious advertisements that contain crafted JavaScript. When a user views the ad, the JavaScript triggers the type confusion.
What is the CVSS score?
The CVSS v3.1 score is 8.8 (High), with a vector of CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
Is there a patch available?
Yes, Google released Chrome 142.0.7444.175 for all platforms. Microsoft also released an Edge update.
How can I detect exploitation attempts?
Monitor for suspicious child processes from Chrome (e.g., PowerShell) and unusual network connections. Use the Sigma and YARA rules provided in this article as a starting point.
Need expert help with this?
CybernytronX specializes in browser exploit mitigation, detection engineering, and incident response. Our team can help you assess your exposure to CVE-2025-66520, deploy effective detection rules, and harden your endpoints against malvertising threats. We also offer Ethereon AI threat detection, which uses machine learning to identify anomalous browser behavior in real time. Contact us at cybernytronx.com/contact or learn more about Ethereon at cybernytronx.com/ethereon.