Multiple Chrome Vulnerabilities Expose Users to Arbitrary Code Execution Attacks

Google has announced the release of Chrome version 141.0.7390.65/.66 for Windows and Mac, as well as 141.0.7390.65 for Linux. This update addresses multiple critical security vulnerabilities that could allow attackers to execute arbitrary code on affected systems.

The update, announced on Sat, Oct 7, 2025, includes three significant security fixes.

Heap Buffer Overflow and Memory Corruption Flaws

The most severe vulnerability addressed is CVE-2025-11458, a heap buffer overflow in Chrome's Sync component with a High severity rating.

This flaw, discovered by security researcher Raven at KunLun lab on Sep 5, 2025, earned a $5,000 bounty from Google's Vulnerability Reward Program.

Heap buffer overflows occur when a program writes data beyond allocated memory buffer boundaries, potentially allowing attackers to corrupt adjacent memory regions and execute arbitrary code.

The second critical vulnerability, CVE-2025-11460, is a Use-After-Free condition in Chrome's Storage component.

Reported by researcher Sombra on Sep 23, 2025, this High-severity flaw occurs when the browser attempts to access memory that has already been freed, creating opportunities for attackers to manipulate memory allocation and achieve code execution.

Additionally, CVE-2025-11211 addresses an out-of-bounds read vulnerability in WebCodecs, reported by Jakob Košir on Aug 29, 2025.

This Medium-severity flaw, which earned a $3,000 reward, allows attackers to read memory outside allocated boundaries, potentially exposing sensitive information or facilitating further exploitation chains.

CVE Title Severity

CVE-2025-11458 Heap buffer overflow in Sync High

CVE-2025-11460 Use after free in Storage High

CVE-2025-11211 Out of bounds read in WebCodecs Medium

Google's security team employed multiple advanced detection methodologies to identify these vulnerabilities, including AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, and AFL fuzzing techniques.

These automated security testing tools continuously analyze Chrome's codebase for memory corruption issues, race conditions, and other security-critical bugs before they reach production environments.

The Chrome development team has implemented comprehensive mitigations within the browser's architecture, including sandboxing mechanisms that isolate rendering processes and limit the potential impact of successful exploits.

Users are advised to install the security update promptly, as Google restricts access to detailed vulnerability information until the majority of users have updated their browsers to prevent widespread exploitation of these critical flaws.

Based on reporting by Cyber Security News.