CVE-2025-0444: High Use after free in Skia.

Q: What is the severity of CVE-2025-0444?

The severity of CVE-2025-0444 is classified as High.

Q: How do I fix CVE-2025-0444?

To fix CVE-2025-0444, update Google Chrome to version 133.0.6943.53 or later.

Q: What type of vulnerability is CVE-2025-0444?

CVE-2025-0444 is a use after free vulnerability in Skia within Google Chrome.

Q: Who is affected by CVE-2025-0444?

Users of Google Chrome versions prior to 133.0.6943.53 are affected by CVE-2025-0444.

Q: What can an attacker do with CVE-2025-0444?

An attacker can potentially exploit heap corruption via a crafted HTML page due to CVE-2025-0444.

Published Jan 19, 2025

Updated

Chromium: CVE-2025-0444 Use after free in Skia

Other sources

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

— Microsoft

Use after free in Skia in Google Chrome prior to 133.0.6943.53 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

— MITRE

Credit

Francisco Alonso@@revskills

Affected Software

6 affected componentsFixes available

Microsoft Edge (Chromium-based)

Patch available

Microsoft Edge<133.0.3065.51

Google Chrome<133.0.6943.53

debian/chromium

150.0.7871.100-1~deb12u1156.0.8078.79-1~deb12u1150.0.7871.181-1~deb13u1156.0.8078.79-1~deb13u1156.0.8078.79-1

debian/webkit2gtk<=2.50.6-1~deb12u2, <=2.50.6-1~deb12u1, <=2.52.6-1~deb13u1, <=2.52.6-1

2.54.0-1~deb13u32.54.2-2

debian/wpewebkit<=2.38.6-1, <=2.48.3-1

2.54.2-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/chromium to a version that resolves this vulnerability.
Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.79-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.79-1~deb13u1Fixed in 156.0.8078.79-1
Upgrade
Upgrade debian/webkit2gtk to a version that resolves this vulnerability.
Fixed in 2.54.0-1~deb13u3Fixed in 2.54.2-2
Upgrade
Upgrade debian/wpewebkit to a version that resolves this vulnerability.
Fixed in 2.54.2-1
Upgrade
Upgrade Google Chrome to a version that resolves this vulnerability.
Fixed in 133.0.6943.53

Event History

Jan 19, 2025

CVE Published

12:00 AM

Data Sourced

12:00 AM

Weakness

Feb 4, 2025

CVE Published

via MITRE·06:53 PM

Data Sourced

via MITRE·06:53 PM

DescriptionWeakness

Data Sourced

via Red Hat·07:01 PM

DescriptionSeverityAffected Software

Data Sourced

via OSV·07:15 PM

DescriptionSeverity

Parent advisories

This vulnerability appears in the following advisories.

Peer vulnerabilities

Found alongside the following vulnerabilities.

Frequently Asked Questions

What is the severity of CVE-2025-0444?

The severity of CVE-2025-0444 is classified as High.

How do I fix CVE-2025-0444?

To fix CVE-2025-0444, update Google Chrome to version 133.0.6943.53 or later.

What type of vulnerability is CVE-2025-0444?

CVE-2025-0444 is a use after free vulnerability in Skia within Google Chrome.

Who is affected by CVE-2025-0444?

Users of Google Chrome versions prior to 133.0.6943.53 are affected by CVE-2025-0444.

What can an attacker do with CVE-2025-0444?

An attacker can potentially exploit heap corruption via a crafted HTML page due to CVE-2025-0444.

CVE-2025-0444: High Use after free in Skia.

Other sources

Credit

Affected Software

Remediation

Event History

Parent advisories

Peer vulnerabilities

Frequently Asked Questions

What is the severity of CVE-2025-0444?

How do I fix CVE-2025-0444?

What type of vulnerability is CVE-2025-0444?

Who is affected by CVE-2025-0444?

What can an attacker do with CVE-2025-0444?

Company

Resources

Contact