CVE-2025-11460: Google Chrome Use After Free Vulnerability

CVE-2025-11460 Overview

CVE-2025-11460 is a use-after-free vulnerability in the Storage component of Google Chrome prior to version 141.0.7390.65. This memory corruption flaw allows a remote attacker to execute arbitrary code by convincing a victim to interact with a specially crafted video file. The vulnerability occurs when the browser improperly handles memory during video processing operations, leading to a condition where freed memory can be accessed and exploited.

Critical Impact
Remote code execution via crafted video file exploitation enables attackers to gain full control of affected systems, potentially compromising user data, installing malware, or using the system as a pivot point for further attacks.

Affected Products

Google Chrome prior to version 141.0.7390.65
Google Chrome on Microsoft Windows
Google Chrome on Apple macOS
Google Chrome on Linux

Discovery Timeline

November 6, 2025 - CVE-2025-11460 published to NVD
November 25, 2025 - Last updated in NVD database

Technical Details for CVE-2025-11460

Vulnerability Analysis

This vulnerability (CWE-416: Use After Free) resides in the Storage component of Google Chrome's rendering engine. The flaw manifests when the browser processes malicious video content, triggering improper memory management that leads to a use-after-free condition. When a victim opens or streams a crafted video file, the browser may reference memory that has already been deallocated, creating an opportunity for attackers to manipulate program execution flow.

The attack requires user interaction—specifically, the victim must be enticed to view a malicious video file, either through a compromised website, malicious advertisement, or direct file delivery. Once triggered, the vulnerability enables arbitrary code execution within the context of the browser process, potentially with the same privileges as the logged-in user.

Root Cause

The root cause stems from improper lifetime management of memory objects within Chrome's Storage component during video file processing. When certain video files are parsed, the browser may free memory objects prematurely while other parts of the code still hold references to that memory. Subsequent operations attempt to access or manipulate this freed memory, leading to undefined behavior that attackers can leverage for code execution.

Attack Vector

The attack is network-based and requires user interaction. An attacker could exploit this vulnerability through several vectors:

Malicious Website: Host a crafted video file on an attacker-controlled website and lure victims to visit the page
Malvertising: Inject malicious video content through compromised advertising networks
Phishing: Send direct links to malicious video content via email or messaging platforms
Compromised Legitimate Sites: Inject malicious video content into legitimate websites through XSS or other web vulnerabilities

The exploitation does not require authentication or any special privileges, making it accessible to remote attackers. The vulnerability affects all major operating systems where Chrome is deployed, including Windows, macOS, and Linux.

Detection Methods for CVE-2025-11460

Indicators of Compromise

Unexpected Chrome browser crashes or instability when processing video content
Unusual child processes spawned by the Chrome browser process
Anomalous network connections originating from Chrome processes to unknown external hosts
Memory access violations or segmentation faults in Chrome crash dumps

Detection Strategies

Monitor Chrome browser versions across the enterprise and flag any instances running versions prior to 141.0.7390.65
Deploy endpoint detection rules to identify suspicious process behavior following video file access in Chrome
Implement network monitoring to detect connections to known malicious domains serving exploit content
Analyze browser crash reports for patterns consistent with use-after-free exploitation attempts

Monitoring Recommendations

Enable Chrome's built-in crash reporting and centralize crash dump analysis for early detection of exploitation attempts
Implement web filtering to block access to untrusted video hosting services and newly registered domains
Monitor for unusual PowerShell, cmd.exe, or shell activity spawned as child processes of Chrome

How to Mitigate CVE-2025-11460

Immediate Actions Required

Update Google Chrome to version 141.0.7390.65 or later immediately across all endpoints
Enable automatic updates for Chrome to ensure timely deployment of future security patches
Educate users about the risks of opening video files from untrusted sources
Consider temporarily restricting access to untrusted video content until patching is complete

Patch Information

Google has released a security update addressing this vulnerability in Chrome version 141.0.7390.65. Organizations should deploy this update immediately through their software management infrastructure. Detailed information about the patch is available in the Google Chrome Desktop Update release notes. Additional technical details can be found in the Chromium Issue Tracker Entry.

Workarounds

Implement strict content filtering policies to block potentially malicious video files at the network perimeter
Deploy browser isolation solutions to contain potential exploitation attempts in sandboxed environments
Consider using enterprise browser policies to restrict video autoplay and limit exposure to malicious content
Enable Chrome's Site Isolation feature to provide additional process-level protection against cross-origin attacks

bash

# Verify Chrome version on Linux/macOS
google-chrome --version
# Expected output: Google Chrome 141.0.7390.65 or higher

# Force Chrome update check
google-chrome --check-for-update-interval=0