Out-of-Bounds Read Vulnerability in QuickJS Engine Affecting Google Products

CVE-2025-62492

What is CVE-2025-62492?

A precision error in floating-point arithmetic within the QuickJS engine's TypedArray.prototype.indexOf() function can lead to an Out-of-Bounds Read. This occurs when a negative fromIndex argument is processed; a small negative value may cause the starting index for element search to be miscalculated. As a result, the engine may attempt to read data beyond the valid bounds of the array, leading to potential information disclosure of sensitive memory contents, contingent upon the execution environment.

References