CVE-2025-8901: Out of bounds write in ANGLE
Chromium: CVE-2025-8901 Out of bounds write in ANGLE
Other sources
Out of bounds write in ANGLE in Google Chrome prior to 139.0.7258.127 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/chromiumto a version that resolves this vulnerability.Fixed in 150.0.7871.100-1~deb12u1Fixed in 156.0.8078.73-1~deb12u1Fixed in 150.0.7871.181-1~deb13u1Fixed in 156.0.8078.73-1~deb13u1Fixed in 156.0.8078.47-1Fixed in 156.0.8078.73-1 - Upgrade
Upgrade
debian/webkit2gtkto a version that resolves this vulnerability.Fixed in 2.54.0-1~deb13u3Fixed in 2.54.2-2 - Upgrade
Upgrade
debian/wpewebkitto a version that resolves this vulnerability.Fixed in 2.54.2-1 - Upgrade
Upgrade
Google Chrome/Chromiumto a version that resolves this vulnerability.Fixed in 139.0.7258.127
Event History
Parent advisories
This vulnerability appears in the following advisories.
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-8901?
CVE-2025-8901 has a high severity level due to the potential for out of bounds memory access.
How do I fix CVE-2025-8901?
To fix CVE-2025-8901, update Google Chrome to version 139.0.7258.127 or later.
What type of attack does CVE-2025-8901 enable?
CVE-2025-8901 allows a remote attacker to perform out of bounds memory access via a crafted HTML page.
In which version of Google Chrome is CVE-2025-8901 fixed?
CVE-2025-8901 is fixed in Google Chrome version 139.0.7258.127.
What component is affected by CVE-2025-8901?
CVE-2025-8901 affects the ANGLE component in Google Chrome.