CVE-2015-2425

ENISA EUVD: EUVD-2015-2518 ↗

Exploited in the Wild ✓ Confirmed 0-Day ★ Google Project Zero

Triaged: March 5, 2026 1 article

VulnLookup ↗ NVD ↗ EUVD ↗ MITRE ↗ Advisory ↗ P0 Sheet ↗ CISA KEV ↗

EPSS Score

Source: FIRST.org · 2026-05-24

34.83%

probability

This CVE has a 34.83% probability of being exploited in the next 30 days.

0% Top 97.1th percentile of all CVEs 100%

CVSS v3.1

Source: NVD

8.8

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Description

Project Zero

Use-after-free in MutationObserver

Affected Products

Attack Intelligence

CWE-118 · Incorrect Access of Indexable Resource ('Range Error') CWE-119 · Buffer Overflow CWE-664 · Improper Control of a Resource Through its Lifetime CWE-787 · Out-of-bounds Write

Google Project Zero

Discovered

July 5, 2015

Patched

July 14, 2015

Reported by

Bill Finlayson of Vectra Networks, Dhanesh Kizhakkinan of FireEye, Peter Pi of TrendMicro

Root Cause Analysis

???

Update2: Patch Tuesday July 2015

Qualys Jul 14, 2015

Signal Intelligence

Confidenceⓘ

95%

EPSS 34.83%

CVSS v3.1 8.8

Mentions 1

Last Seen Jul 14, 2015

CNA Information

Analyst Note

Auto-imported from Google Project Zero — confirmed zero-day by definition.

Triage Info

Decided atMar 05, 2026