The attack exploiting CVE-2025-1920 and CVE-2025-2135 begins with attackers crafting a malicious HTML page containing specially designed JavaScript code that triggers a type confusion vulnerability in Chrome’s V8 JavaScript engine. This flaw allows the attacker to manipulate memory allocations, leading to heap corruption and potential arbitrary code execution. To lure victims, attackers distribute the malicious link via phishing emails, compromised websites, malvertising campaigns or social engineering tactics. Once the victim visits the infected webpage, the embedded JavaScript executes, exploiting the vulnerability to bypass memory safety checks and overwrite key memory regions. This allows attackers to download and execute malware, hijack browser sessions, steal authentication tokens, exfiltrate sensitive data, or escalate privileges for deeper system access. Since these vulnerabilities can be leveraged in drive by attacks and chained with privilege escalation exploits, they pose a severe risk to both individual users and corporate environments.