CVE-2025-12036 취약점: 새로운 크리티컬 Chrome V8 JavaScript 원격 코드 실행 취약점

Ruslan Mikhalov Chief of Threat Research at SOC Prime

CVE-2025-12036 취약점: 새로운 크리티컬 Chrome V8 JavaScript 원격 코드 실행 취약점

Detection stack

AIDR
Alert
ETL
Query

위협 보고서
탐지
시뮬레이션

분석

CVE‑2025‑62215는 Windows 커널에서 발생하는 중요한 경쟁 조건 취약점으로, Microsoft가 2025년 11월 패치 화요일 릴리스에서 이를 해결했습니다. 이 결함은 낮은 권한의 로컬 액세스 권한을 가진 공격자가 커널 메모리에서 ‘이중 해제’ 조건을 악용하여 SYSTEM 권한으로 권한을 상승시킬 수 있게 합니다. 이는 적극적으로 악용되고 있으며 모든 지원 Windows OS 에디션(Windows 10의 ESU 포함)에 영향을 미치기 때문에, 조직은 전체 시스템 손실의 실제 위험에 직면해 있습니다.

조사

CVE-2025-12036 노출을 조사하기 위해 보안 팀은 Chrome이나 기타 Chromium 기반 브라우저를 사용하는 모든 엔드포인트를 매핑하는 것으로 시작해야 합니다. Windows, macOS 및 Linux 전반에 걸쳐 브라우저 버전을 조사하고 Chrome 141.0.7390.122/.123 이전의 빌드에서 실행 중인 시스템을 잠재적으로 취약한 것으로 표시하십시오. 다음으로, 갱신되지 않은 엔드포인트와 높은 위험의 브라우징 활동 기간을 관련짓습니다. 예를 들어, 신뢰할 수 없는 웹사이트 접근, 최근 피싱 캠페인 또는 워터링 홀 도메인이 의심되는 장소에 대한 접근 등을 말합니다. 의심스럽거나 새로 등록된 도메인 방문을 위한 EDR 도구, 브라우저 확장 로그 및 프록시 또는 방화벽 로그의 텔레메트리를 검토하여 중대한 JavaScript가 제공되는 사이트, 브라우저 충돌 또는 비정상적인 샌드박스 동작을 염탐 시도를 나타낼 수 있는 것, 브라우저에서 생성된 명령 셸 또는 스크립트 엔진을 포함하는 비정상적인 프로세스 체인을 확인합니다. 커버리지를 깊게 하기 위해, CVE 태그가 포함된 탐지 콘텐츠와 사냥 쿼리를 SIEM, EDR 및 데이터 레이크에서 사용하고, Drive-by Compromise 및 클라이언트 실행용 악용과 같은 MITRE ATT&CK 기술에 대한 발견을 정렬합니다.

완화

사용자가 악성 페이지에 도달하자마자 CVE-2025-12036을 악용하는 것은 간단하기 때문에 패치가 긴급하게 처리되어야 합니다. Windows 및 macOS에서는 Chrome과 Chromium 기반 브라우저 모두 최소한 Chrome 141.0.7390.122/.123으로, Linux에서는 141.0.7390.122로 업데이트되어야 하며 가능한 한 자동 업데이트가 활성화되어야 합니다. 보안 팀은 사용자가 방문하도록 지시하거나 MDM을 통해 강제조치를 하여 패치 상태를 확인해야 합니다. 설정 → Chrome 정보 브라우저가 최신 수정 사항을 가져와 적용할 수 있도록 하십시오. 동시에 엔드포인트에서 최소 권한을 강제하여 브라우저 사용을 강화하고, URL 필터링과 안전한 웹 게이트웨이를 사용하여 악성 또는 고위험 도메인을 차단하며, 사이트 격리 및 엄격한 확장 정책과 같은 보호 장치를 활성화하십시오. 마지막으로, CVE-2025-12036을 취약점 관리에 통합하여 구형 Chrome 빌드가 설치된 새로 배포되거나 거의 사용되지 않는 시스템이 신속히 식별 및 수정되도록 하십시오.

대응

환경에서 CVE-2025-12036이 악용되었다고 의심될 경우, 불신 네트워크로부터 분리를 시작하여 영향을 받은 엔드포인트를 포렌식 분석을 위해 접근 가능하게 유지합니다. 브라우저와 관련된 프로세스의 메모리 이미지, 시스템 및 애플리케이션 로그(특히 Chrome 충돌 보고서 및 브라우저 기록), 의심되는 악용 창 동안의 네트워크 캡처 등 증거를 보존하십시오. 그런 다음, 악용 후 활동을 찾기 위해 사냥을 시작합니다: 새로 등록된 작업 또는 서비스와 같은 비정상적인 지속 메커니즘, 위험한 브라우징 세션 후 드롭된 의심스러운 바이너리나 스크립트, 암호 저장소 접근, 토큰 덤핑 혹은 비정상적인 인증 이벤트 같은 자격 증명 도난의 징후를 찾습니다. 악성 파일 및 지속성을 갖고 있는 아티팩트를 제거하거나 필요하다면 위험성이 높은 엔드포인트를 재프로비저닝하며 격리 및 제거 작업을 수행합니다. 마지막으로, 자격 증명을 회전시키고, 브라우저/V8 RCE 패턴에 대한 탐지 콘텐츠를 업데이트하고, CVE-2025-12036과 관련된 드라이브 바이 악용 위험 및 안전한 브라우징 관행에 대해 사용자 및 관리자에게 보고하십시오.

탐지 규칙

이 부분은 아직 업데이트 중입니다. 알림을 받으려면 등록하십시오

알림 받기

페이로드 지침

이 부분은 아직 업데이트 중입니다. 알림을 받으려면 등록하십시오

알림 받기

SOC Prime의 Detection as Code 플랫폼에 가입하세요 귀하의 비즈니스와 가장 관련 있는 위협에 대한 가시성을 향상시키세요. 시작하고 즉각적인 가치를 창출하기 위해 지금 SOC Prime 전문가와의 미팅을 예약하세요.

무료 가입하기

Name	Descripiton
PHPSESSID	Preserves user session state across page requests. Cookie generated by applications based on the PHP language. This is a general purpose identifier used to maintain user session variables. It is normally a random generated number, how it is used can be specific to the site, but a good example is maintaining a logged-in status for a user between pages.
sp_i	Used to store information about authenticated User.
sp_r	Used to store information about authenticated User.
sp_a	Used to store information about authenticated User.

Name	Descripiton
tuuid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
tuuid_last_update	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
um	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
umeh	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded.
na_sc_x	Used by the social sharing platform AddThis to keep a record of parts of the site that has been visited in order to recommend other parts of the site.
APID	Collects anonymous data related to the user's visits to the website.
IDSYNC	Collects anonymous data related to the user's visits to the website.
_cc_aud	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_cc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_dc	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
_cc_id	Collects anonymous statistical data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The purpose is to segment the website's users according to factors such as demographics and geographical location, in order to enable media and marketing agencies to structure and understand their target groups to enable customised online advertising.
dpm	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
acs	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
clid	Collects anonymous data related to the user's visits to the website, such as the number of visits, average time spent on the website and what pages have been loaded, with the purpose of displaying targeted ads.
KRTBCOOKIE_#	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PUBMDCID	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
PugT	Registers a unique ID that identifies the user's device during return visits across websites that use the same ad network. The ID is used to allow targeted ads.
ssi	Registers a unique ID that identifies a returning user's device. The ID is used for targeted ads.
_tmid	Registers a unique ID that identifies the user's device upon return visits. The ID is used to target ads in video clips.
wam-sync	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
wui	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
AFFICHE_W	Used by the advertising platform Weborama to determine the visitor's interests based on pages visits, content clicked and other actions on the website.
B	Collects anonymous data related to the user's website visits, such as the number of visits, average time spent on the website and what pages have been loaded. The registered data is used to categorise the users' interest and demographical profiles with the purpose of customising the website content depending on the visitor.
1P_JAR	These cookies are used to gather website statistics, and track conversion rates.
APISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
HSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
NID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SAPISID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
SIDCC	Security cookie to protect users data from unauthorised access.
SSID	Google set a number of cookies on any page that includes a Google reCAPTCHA. While we have no control over the cookies set by Google, they appear to include a mixture of pieces of information to measure the number and behaviour of Google reCAPTCHA users.
__utmx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.
__utmxx	This cookie is associated with Google Website Optimizer, a tool designed to help site owners improve their wbesites. It is used to distinguish between two varaitions a webpage that might be shown to a visitor as part of an A/B split test. This helps site owners to detemine which version of a page performs better, and therefore helps to improve the website.

Name	Descripiton
_hjid	Hotjar cookie. This cookie is set when the customer first lands on a page with the Hotjar script. It is used to persist the random user ID, unique to that site on the browser. This ensures that behavior in subsequent visits to the same site will be attributed to the same user ID.
_hjIncludedInSample	This cookie is associated with web analytics functionality and services from Hot Jar, a Malta based company. It uniquely identifies a visitor during a single browser session and indicates they are included in an audience sample.
intercom-id-[xxx]	This cookie is used by Intercom as a session so that users can continue a chat as they move through the site.
intercom-session-[xxx]	Used to keeping track of sessions and remember logins and conversations.
demdex	Via a unique ID that is used for semantic content analysis, the user's navigation on the website is registered and linked to offline data from surveys and similar registrations to display targeted ads.
CookieConsent	Stores the user's cookie consent state for the current domain.
__cfduid	Used by the content network, Cloudflare, to identify trusted web traffic.
ss	These cookies enable the website to provide enhanced functionality and personalisation . They may be set by us or by third party providers whose services we have added to our pages. These services may include the Live Chat facility, Contact Us form(s), the Product Quotation forms and submission process, and the Email Newsletter sign up functionality .

Name	Descripiton
_ga	This cookie name is asssociated with Google Universal Analytics - which is a significant update to Google's more commonly used analytics service. This cookie is used to distinguish unique users by assigning a randomly generated number as a client identifier. It is included in each page. Registers a unique ID that is used to generate statistical data on how the visitor uses the website. request in a site and used to calculate visitor, session and campaign data for the sites analytics reports. By default it is set to expire after 2 years, although this is customisable by website owners.
_gat	Used by Google Analytics to throttle request rate. This cookie name is associated with Google Universal Analytics, according to documentation it is used to throttle the request rate - limiting the collection of data on high traffic sites. It expires after 10 minutes.
_gid	This cookie name is asssociated with Google Universal Analytics. This appears to be a new cookie and as of Spring 2017 no information is available from Google. It appears to store and update a unique value for each page visited. Registers a unique ID that is used to generate statistical data on how the visitor uses the website.
IDE	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
r/collect	Used by Google DoubleClick to register and report the website user's actions after viewing or clicking one of the advertiser's ads with the purpose of measuring the efficacy of an ad and to present targeted ads to the user.
test_cookie	Used to check if the user's browser supports cookies.
collect	Used to send data to Google Analytics about the visitor's device and behaviour. Tracks the visitor across devices and marketing channels.
ads/user-lists/#	These cookies may be set through our site by our advertising partners. They may be used by those companies to build a profile of your interests and show you relevant adverts on other sites.
c	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
khaos	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
put_#	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpb	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
rpx	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.
tap.php	Registers anonymised user data, such as IP address, geographical location, visited websites, and what ads the user has clicked, with the purpose of optimising ad display based on the user's movement on websites that use the same ad network.