Log in Start free

Vulnerability · Published May 27, 2025 · Assigned by Chrome

CVE-2025-5283

Medium 5.4

In plain English

A medium-severity use-after-free in Chrome from Google. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 51% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.4Medium
Exploit odds (30 days)0.6%top 49.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Use after free in libvpx in Google Chrome prior to 137.0.7151.55 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium)

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
AlmaLinux:10firefox128.11.0-1.el10_0ALSA-2025:8341
AlmaLinux:8firefox128.11.0-1.el8_10.alma.1ALSA-2025:8308
AlmaLinux:10libvpx1.14.1-3.el10_0ALSA-2025:9120
AlmaLinux:8libvpx1.7.0-12.el8_10ALSA-2025:9119
AlmaLinux:9libvpx1.9.0-9.el9_6ALSA-2025:9118
AlmaLinux:10libvpx-devel1.14.1-3.el10_0ALSA-2025:9120
AlmaLinux:8libvpx-devel1.7.0-12.el8_10ALSA-2025:9119
AlmaLinux:9libvpx-devel1.9.0-9.el9_6ALSA-2025:9118
AlmaLinux:9thunderbird128.11.0-1.el9_6.alma.1ALSA-2025:8607
Alpine:v3.22qt6-qtwebengine6.8.3-r1ALPINE-CVE-2025-5283
Alpine:v3.23qt6-qtwebengine6.8.3-r1ALPINE-CVE-2025-5283
Alpine:v3.24qt6-qtwebengine6.8.3-r1ALPINE-CVE-2025-5283
Debian:12chromium137.0.7151.55-3~deb12u1DEBIAN-CVE-2025-5283
Debian:12chromium137.0.7151.55-3~deb12u1DSA-5929-1
Debian:13chromium137.0.7151.55-1DEBIAN-CVE-2025-5283
Debian:14chromium137.0.7151.55-1DEBIAN-CVE-2025-5283
Debian:12firefox-esr128.11.0esr-1~deb12u1DSA-5926-1
Debian:12firefox-esr128.11.0esr-1~deb12u1DEBIAN-CVE-2025-5283
Debian:13firefox-esr128.11.0esr-1DEBIAN-CVE-2025-5283
Debian:14firefox-esr128.11.0esr-1DEBIAN-CVE-2025-5283
Debian:12libvpx1.12.0-1+deb12u4DEBIAN-CVE-2025-5283
Debian:12libvpx1.12.0-1+deb12u4DSA-5928-1
Debian:13libvpx1.15.0-2.1DEBIAN-CVE-2025-5283
Debian:14libvpx1.15.0-2.1DEBIAN-CVE-2025-5283
Debian:12thunderbird1:128.11.0esr-1~deb12u1DSA-5932-1
Debian:12thunderbird1:128.11.0esr-1~deb12u1DEBIAN-CVE-2025-5283
Debian:13thunderbird1:128.11.0esr-1DEBIAN-CVE-2025-5283
Debian:14thunderbird1:128.11.0esr-1DEBIAN-CVE-2025-5283
Rocky Linux:10firefox0:128.11.0-1.el10_0RLSA-2025:8341
Rocky Linux:8firefox0:128.11.0-1.el8_10RLSA-2025:8308
Rocky Linux:9firefox0:128.11.0-1.el9_6RLSA-2025:8293
Rocky Linux:10libvpx0:1.14.1-3.el10_0RLSA-2025:9120
Rocky Linux:8libvpx0:1.7.0-12.el8_10RLSA-2025:9119
Rocky Linux:9libvpx0:1.9.0-9.el9_6RLSA-2025:9118
Rocky Linux:10thunderbird0:128.11.0-1.el10_0RLSA-2025:8608
Rocky Linux:8thunderbird0:128.11.0-1.el8_10RLSA-2025:8756
Rocky Linux:9thunderbird0:128.11.0-1.el9_6RLSA-2025:8607
Ubuntu:22.04:LTSlibvpx1.11.0-2ubuntu2.4USN-7551-1
Ubuntu:22.04:LTSlibvpx1.11.0-2ubuntu2.4UBUNTU-CVE-2025-5283
Ubuntu:24.04:LTSlibvpx1.14.0-1ubuntu2.2USN-7551-1
Ubuntu:24.04:LTSlibvpx1.14.0-1ubuntu2.2UBUNTU-CVE-2025-5283
Ubuntu:22.04:LTSmozjs102no fix listedUBUNTU-CVE-2025-5283
Ubuntu:24.04:LTSmozjs102no fix listedUBUNTU-CVE-2025-5283
Ubuntu:24.04:LTSmozjs115no fix listedUBUNTU-CVE-2025-5283
Ubuntu:22.04:LTSmozjs78no fix listedUBUNTU-CVE-2025-5283
Ubuntu:22.04:LTSmozjs91no fix listedUBUNTU-CVE-2025-5283
Ubuntu:22.04:LTSthunderbird1:140.7.1+build1-0ubuntu0.22.04.1UBUNTU-CVE-2025-5283

Affected products (as reported)

VendorProductVersions
Google Chrome 137.0.7151.55 – before 137.0.7151.55

Weakness: CWE-416 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

References