CVE-2025-11215: Google Chrome Buffer Overflow Vulnerability

CVE-2025-11215 Overview

CVE-2025-11215 is an off-by-one error in the V8 JavaScript engine used by Google Chrome versions prior to 141.0.7390.54. A remote attacker can trigger an out-of-bounds memory read by convincing a user to visit a crafted HTML page. The flaw is tracked under CWE-193: Off-by-one Error and affects Chrome installations on Windows, macOS, and Linux. Google assigned this issue a Chromium security severity of Medium and addressed it in the stable channel release announced in the Google Chrome Stable Update.

Critical Impact
A remote attacker can read out-of-bounds memory from the V8 heap by luring a user to a malicious HTML page, potentially leaking sensitive process memory.

Affected Products

Google Chrome versions prior to 141.0.7390.54
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers that embed the vulnerable V8 build

Discovery Timeline

2025-11-06 - CVE-2025-11215 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11215

Vulnerability Analysis

The vulnerability resides in V8, the JavaScript and WebAssembly engine that Chrome uses to parse and execute web content. An off-by-one condition causes V8 to read one element beyond the intended bounds of a buffer or object. The resulting out-of-bounds read exposes adjacent memory contents to attacker-controlled JavaScript running in the renderer process.

The attack requires user interaction: the target must load a crafted HTML page in a vulnerable Chrome build. Exploitation does not require prior authentication or elevated privileges. The impact is limited to confidentiality of information rendered accessible through the out-of-bounds access, with no direct integrity or availability effect reported by Google.

Root Cause

Off-by-one errors typically arise when a loop bound, index calculation, or size check uses <= where < was intended, or fails to account for a terminating element. In V8, such a miscalculation on a typed array, JIT-generated code path, or internal object slot can cause the engine to dereference one slot past the allocated region. Full technical details are tracked in the Chromium Issue Tracker entry.

Attack Vector

An attacker hosts a malicious HTML page containing JavaScript designed to trigger the vulnerable V8 code path. When a user visits the page, the crafted script forces V8 to perform the boundary-violating read. The leaked memory can contain pointers, object metadata, or user data from the renderer process. Attackers commonly chain such reads with additional bugs to build reliable sandbox-escape or remote code execution primitives.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. See the Chromium Issue Tracker entry for engine-level context.

Detection Methods for CVE-2025-11215

Indicators of Compromise

Chrome renderer processes crashing or logging V8 sanitizer diagnostics after visiting untrusted pages
Outbound connections from browser hosts to domains serving unusual or heavily obfuscated JavaScript payloads
Endpoints reporting Chrome browser versions below 141.0.7390.54 in inventory data

Detection Strategies

Query endpoint inventory to identify Chrome installations below the patched build across Windows, macOS, and Linux fleets
Correlate browsing telemetry with threat intelligence feeds to flag access to pages known to serve V8 exploits
Monitor for anomalous renderer process behavior, including unexpected child processes or memory access patterns

Monitoring Recommendations

Ingest Chrome update and version telemetry into the SIEM to track patch adoption over time
Alert on Chrome crash reports containing V8 or OOB sanitizer signatures
Track proxy and DNS logs for repeated user redirection to newly registered or low-reputation domains delivering active content

How to Mitigate CVE-2025-11215

Immediate Actions Required

Update Google Chrome to version 141.0.7390.54 or later on all Windows, macOS, and Linux endpoints
Restart Chrome after updating to ensure the patched V8 build is loaded into every renderer process
Audit managed Chromium-based browsers such as Microsoft Edge and Brave for equivalent V8 patch levels

Patch Information

Google released the fix in the Chrome stable channel update documented in the Google Chrome Stable Update advisory. Enterprise administrators should push the update through Google Update, Chrome Browser Cloud Management, or their standard software distribution tooling. Verify installed builds report 141.0.7390.54 or higher.

Workarounds

Enforce Chrome auto-update policies so patched builds deploy without user intervention
Restrict user browsing to trusted sites using web filtering or DNS security controls until patching completes
Consider enabling Chrome's Site Isolation and strict Enhanced Safe Browsing settings to reduce exposure to malicious pages

bash

# Verify installed Chrome version on Linux endpoints
google-chrome --version

# Windows: query installed version via registry
reg query "HKLM\SOFTWARE\Google\Chrome\BLBeacon" /v version

# macOS: read version from the application bundle
defaults read "/Applications/Google Chrome.app/Contents/Info.plist" CFBundleShortVersionString