CVE-2025-11458: Google Chrome Buffer Overflow Vulnerability

CVE-2025-11458 Overview

CVE-2025-11458 is a heap buffer overflow vulnerability in the Sync component of Google Chrome prior to version 141.0.7390.65. A remote attacker can trigger an out-of-bounds memory read by serving a crafted HTML page to a target user. Chromium classifies the security severity as High.

The vulnerability affects Chrome installations on Windows, macOS, and Linux. Exploitation requires user interaction, specifically navigation to attacker-controlled content. The flaw maps to CWE-122: Heap-based Buffer Overflow and CWE-787: Out-of-bounds Write.

Critical Impact
Successful exploitation allows attackers to read sensitive heap memory contents, potentially leaking credentials, tokens, or other process data from the browser's Sync subsystem.

Affected Products

Google Chrome prior to 141.0.7390.65 on Microsoft Windows
Google Chrome prior to 141.0.7390.65 on Apple macOS
Google Chrome prior to 141.0.7390.65 on Linux

Discovery Timeline

2025-11-06 - CVE-2025-11458 published to the National Vulnerability Database
2025-11-25 - Last updated in NVD database

Technical Details for CVE-2025-11458

Vulnerability Analysis

The vulnerability resides in the Sync component of Chromium, which handles synchronization of user data such as bookmarks, history, passwords, and settings across devices. A heap-based buffer overflow condition permits an out-of-bounds memory read when the component processes attacker-controlled input delivered through a crafted HTML page.

The Sync subsystem parses and serializes structured data exchanged between the browser and Google's sync servers. When boundary checks fail during this processing, the renderer or related process reads memory beyond the intended buffer. This leak can disclose adjacent heap contents to the attacker's controlled context.

Root Cause

The root cause is improper bounds validation in heap-allocated buffers within the Sync code path. Memory safety issues of this class typically arise from incorrect length calculations, missing size checks before memcpy-style operations, or untrusted size fields being trusted during deserialization.

Attack Vector

An attacker hosts a malicious HTML page and lures a victim to visit it. When the victim's Chrome browser loads the page, content interacts with the Sync component in a way that triggers the out-of-bounds read. The attack is network-reachable, requires low complexity, and depends on user interaction such as clicking a link or visiting a compromised site.

No public exploit code or proof-of-concept has been published. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. The EPSS probability is 0.043%.

Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Blog for vendor-published technical context.

Detection Methods for CVE-2025-11458

Indicators of Compromise

Chrome renderer or browser process crashes with heap corruption signatures originating from the Sync component
Outbound connections from Chrome to untrusted domains immediately preceding renderer instability
Anomalous HTML payloads delivered via phishing or malvertising that trigger Sync-related code paths

Detection Strategies

Inventory Chrome versions across managed endpoints and flag installations below 141.0.7390.65
Correlate browser process crash telemetry with recent navigation events to identify suspicious URLs
Monitor web proxy and DNS logs for known malicious domains used in browser exploitation campaigns

Monitoring Recommendations

Forward Chrome crash dumps and process telemetry to a centralized log platform for analysis
Track patch compliance metrics for Chrome through endpoint management tooling
Alert on unsigned or anomalous child processes spawned by chrome.exe after navigation events

How to Mitigate CVE-2025-11458

Immediate Actions Required

Update Google Chrome to version 141.0.7390.65 or later on all Windows, macOS, and Linux endpoints
Restart Chrome on managed devices to ensure the patched binary is loaded into memory
Verify enterprise update policies are not blocking or delaying Chrome stable channel updates

Patch Information

Google released the fix in Chrome Stable channel version 141.0.7390.65. Administrators should consult the Google Chrome Update Blog for full release notes and deploy the update through Chrome Browser Cloud Management, Group Policy, or platform package managers.

Workarounds

Disable Chrome Sync via enterprise policy (SyncDisabled) for users who do not require the feature until patching completes
Restrict browsing to trusted sites through web filtering or DNS-layer controls to reduce exposure to crafted HTML pages
Enforce Site Isolation and Strict Site Isolation policies to limit cross-site memory exposure

bash

# Configuration example: disable Chrome Sync via policy on Linux
sudo mkdir -p /etc/opt/chrome/policies/managed
sudo tee /etc/opt/chrome/policies/managed/disable-sync.json > /dev/null <<EOF
{
  "SyncDisabled": true
}
EOF