Chrome Patches Eighth Zero-Day of 2025 (CVE-2025-13223)

Google Patches Actively Exploited Chrome Zero-Day Flaw (CVE-2025-13223)

• Google has released an emergency security update for Chrome, addressing CVE-2025-13223, an actively exploited zero-day vulnerability.
• The flaw is an integer overflow within the Mojo API, potentially leading to arbitrary code execution or sandbox escape, marking the eighth Chrome zero-day patched this year.
• Users are urged to update Chrome immediately to version 129.0.6647.110 or later across all platforms to mitigate the risk of active exploitation.

Source: SecurityOnline.info | Date: November 17, 2025

New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT

• A new EVALUSION ClickFix campaign leverages SEO poisoning and malvertising to direct victims to malicious websites, initiating the deployment of Amatera Stealer and NetSupport RAT.
• The attackers use JavaScript code on compromised sites to check for specific user and system conditions, enabling evasive malware delivery that bypasses security measures.
• Amatera Stealer, a key component of the campaign, is designed to exfiltrate sensitive user data, including stored browser credentials, cryptocurrency wallet details, and system information.

Source: The Hacker News | Date: November 17, 2025

More Prompt||GTFO: Browser AI Prompt Injection Vulnerabilities

• Security researchers have highlighted a new "Prompt||GTFO" attack vector, enabling prompt injection against AI assistants integrated into web browsers.
• This technique leverages hidden HTML elements within an iframe to manipulate the AI's understanding, allowing for the exfiltration of sensitive user data, such as email addresses, by bypassing cross-origin policies.
• The Brave Browser team identified and responsibly disclosed this vulnerability in Opera Neon's AI assistant, demonstrating its potential for cross-origin data leaks.

Source: Schneier on Security | Date: November 17, 2025

Firefox Releases Critical Security Update to Patch 16 Vulnerabilities Including Remote Code Execution Flaws

• Mozilla released Firefox version 145 on November 11, 2025, addressing 16 CVEs affecting graphics, JavaScript, and DOM components, with eight rated as high severity vulnerabilities that could allow attackers to execute arbitrary code on users' systems
• The most critical issue is CVE-2025-13027, a cluster of memory safety bugs discovered by Mozilla's Fuzzing Team that demonstrate memory corruption patterns, which determined attackers could exploit to achieve remote code execution, potentially bypassing browser sandboxes and compromising entire devices.
• Security researchers identified multiple high-severity flaws including CVE-2025-13021, CVE-2025-13022, and CVE-2025-13025 involving incorrect boundary conditions in WebGPU processing, along with WebRTC use-after-free errors that could expose audio and video streams.

Source: Cyber Press | Date: November 17, 2025

References

1. Google Patches Actively Exploited Chrome Zero-Day Flaw (CVE-2025-13223) in Emergency Update - SecurityOnline.info
2. New EVALUSION ClickFix Campaign Delivers Amatera Stealer and NetSupport RAT - The Hacker News
3. More Prompt||GTFO - Schneier on Security
4. Firefox Releases Security Update to Fix Multiple Vulnerabilities Allowing Arbitrary Code Execution - Cyber Press