CVE-2025-13720: 
vulnerability analysis and mitigation

CVE-2025-13720 is a "bad cast" vulnerability in the Loader component of Google Chrome that can lead to heap corruption. It affects all Google Chrome versions prior to 143.0.7499.41 (Windows/Mac) and 143.0.7499.40 (Linux), as well as Microsoft Edge (Chromium-based). The vulnerability was internally reported by the Chrome team on November 4, 2025, and publicly disclosed on December 2, 2025, as part of the Chrome 143 stable channel release. It carries a CVSS v3.1 base score of 8.8 (High) (Chrome Releases, Microsoft MSRC).

The vulnerability is classified as CWE-704 (Incorrect Type Conversion or Cast), specifically a "bad cast" in Chrome's Loader component — the subsystem responsible for loading web resources and documents. An attacker who has already compromised the renderer process can trigger an incorrect type cast via a specially crafted HTML page, leading to heap memory corruption. Because exploitation requires a pre-compromised renderer, this vulnerability is typically chained with a separate renderer exploit (e.g., a V8 or Blink bug) to achieve a full sandbox escape. The Chromium issue tracker entry is referenced as issue #457818670 (Chrome Releases).

Successful exploitation could allow an attacker who has already compromised the renderer process to corrupt heap memory, potentially leading to arbitrary code execution outside the Chrome sandbox. This could result in full compromise of the confidentiality, integrity, and availability of the affected system, including access to sensitive browser data, credentials, and the ability to execute attacker-controlled code with the privileges of the Chrome process. The vulnerability requires user interaction (visiting a malicious web page) and a pre-existing renderer compromise, limiting its standalone impact but making it a significant link in a multi-stage exploit chain (Chrome Releases).

As of the time of disclosure, there is no public proof-of-concept exploit and no evidence of in-the-wild exploitation for CVE-2025-13720. The EPSS score is approximately 0.069%, reflecting a low near-term exploitation probability. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Chromium's internal security team discovered and reported the issue, and bug details remain restricted pending broad user adoption of the patch (Chrome Releases).

Google has addressed this vulnerability in Chrome 143.0.7499.40 (Linux) and 143.0.7499.40/41 (Windows/Mac). Microsoft Edge (Chromium-based) users should apply the corresponding Edge update referencing this CVE. Users should update Chrome immediately via the browser's built-in update mechanism (Settings → Help → About Google Chrome). No configuration-based workaround is available; updating to the patched version is the only remediation. Enterprise administrators should prioritize deploying the update via their software management tools (Chrome Releases, Microsoft MSRC).

The Chrome 143 release, which included fixes for 13 security vulnerabilities including CVE-2025-13720, received broad coverage from security media outlets. Publications such as CyberSecurityNews, GBHackers, Forbes, and BleepingComputer highlighted the update, with Forbes urging Chrome's approximately 3 billion users to update immediately. The Zero Day Initiative's December 2025 security update review and Sophos's Patch Tuesday blog also noted the Chrome 143 release in the context of the broader December 2025 patch cycle (CyberSecurityNews, Forbes, Sophos Blog).