CVE-2025-11756: Google Chrome Use After Free Vulnerability

CVE-2025-11756 Overview

CVE-2025-11756 is a use-after-free vulnerability [CWE-416] in the Safe Browsing component of Google Chrome. The flaw affects all Chrome versions prior to 141.0.7390.107 across Windows, macOS, and Linux. A remote attacker who has already compromised the renderer process can trigger out-of-bounds memory access through a crafted HTML page. Google rates the Chromium security severity as High. Successful exploitation requires user interaction, such as visiting an attacker-controlled web page. The vulnerability can lead to memory corruption that may be chained with sandbox escapes to achieve broader system compromise.

Critical Impact
Remote attackers who have compromised the renderer can perform out-of-bounds memory access via crafted HTML, enabling potential sandbox escape and arbitrary code execution chains.

Affected Products

Google Chrome versions prior to 141.0.7390.107
Chrome on Microsoft Windows, Apple macOS, and Linux
Chromium-based browsers that incorporate the vulnerable Safe Browsing component

Discovery Timeline

2025-11-06 - CVE-2025-11756 published to NVD
2025-11-25 - Last updated in NVD database

Technical Details for CVE-2025-11756

Vulnerability Analysis

The vulnerability resides in Chrome's Safe Browsing subsystem, which inspects URLs and resources against threat lists before rendering. A use-after-free condition [CWE-416] occurs when the component continues to reference memory that has already been deallocated. An attacker who has previously compromised the renderer process can manipulate object lifetimes by serving a crafted HTML page. When the freed object is reused, attacker-controlled data can be written to or read from invalid memory regions. This produces an out-of-bounds memory access primitive that an attacker can refine into arbitrary read or write capabilities within the renderer address space.

Root Cause

Use-after-free defects arise when code retains a dangling pointer to an object whose backing memory has been released to the allocator. In this case, the Safe Browsing logic does not correctly synchronize object lifetime with operations triggered by HTML content processing. Subsequent allocations can place attacker-controlled data into the reclaimed slot, allowing the dangling reference to interpret hostile data as a valid object.

Attack Vector

Exploitation requires a multi-stage approach. The attacker must first compromise the renderer process, typically through a separate vulnerability or by luring a user to a malicious page. The attacker then serves crafted HTML that interacts with Safe Browsing code paths in a manner that triggers the dangling pointer. The resulting out-of-bounds access can be paired with sandbox escape techniques to break out of the renderer and reach the broader operating system. Verified public proof-of-concept code is not currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploitation code is publicly available. Refer to the Chromium Issue Tracker entry for technical disclosure status.

Detection Methods for CVE-2025-11756

Indicators of Compromise

Chrome renderer processes (chrome.exe --type=renderer) terminating unexpectedly with access violation or segmentation fault crash signatures.
Outbound connections from Chrome to unfamiliar domains immediately preceding renderer crashes, suggesting delivery of a crafted exploit page.
Spawning of unexpected child processes by Chrome following navigation to untrusted sites, which can indicate a successful sandbox escape chain.

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any host running a build earlier than 141.0.7390.107.
Monitor Chrome crash telemetry and Windows Error Reporting data for repeated renderer faults that align with browsing activity to suspicious URLs.
Hunt for process lineage anomalies where Chrome renderer children launch shells, scripting hosts, or LOLBins.

Monitoring Recommendations

Forward browser process telemetry, navigation history, and crash events into a centralized analytics platform for correlation.
Track Safe Browsing block events alongside renderer process stability metrics to identify hosts targeted by exploit delivery infrastructure.
Apply web proxy and DNS logging to identify users visiting newly registered or low-reputation domains that match Chrome exploit delivery patterns.

How to Mitigate CVE-2025-11756

Immediate Actions Required

Update Google Chrome to version 141.0.7390.107 or later on all Windows, macOS, and Linux endpoints.
Restart browser sessions after updating, since Chrome only applies patches once the process is relaunched.
Audit Chromium-derived browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream fix.

Patch Information

Google addressed CVE-2025-11756 in the Stable Channel update released on October 14, 2025. Chrome 141.0.7390.107 and later contain the fix. Administrators should consult the Google Chrome Stable Channel Update notification and the Chromium Issue Tracker entry for additional technical context. Enterprise deployments using Chrome Browser Cloud Management or Group Policy should verify update enforcement settings.

Workarounds

No vendor-supplied workaround exists. Patching to 141.0.7390.107 or later is the only supported remediation.
Restrict browsing to trusted sites through web filtering or enterprise policy until patches are deployed.
Enforce Chrome's Enhanced Safe Browsing and site isolation features to raise the cost of renderer compromise that precedes exploitation.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "$Env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion