CVE-2025-11756
📋 TL;DR
A use-after-free vulnerability in Google Chrome's Safe Browsing feature allows attackers who have already compromised the renderer process to potentially access out-of-bounds memory via a crafted HTML page. This could lead to further exploitation like remote code execution. All Chrome users on versions before 141.0.7390.107 are affected.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Full remote code execution leading to complete system compromise, data theft, or ransomware deployment.
Likely Case
Memory corruption leading to browser crash (denial of service) or limited information disclosure.
If Mitigated
Attack fails due to sandboxing or exploit mitigations, resulting in only a browser crash.
🎯 Exploit Status
Exploitation requires first compromising the renderer process through another vulnerability, making this a secondary exploitation vector.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 141.0.7390.107 and later
Vendor Advisory: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_14.html
Restart Required: Yes
Instructions:
1. Open Chrome. 2. Click the three-dot menu. 3. Go to Help > About Google Chrome. 4. Chrome will automatically check for and install updates. 5. Click Relaunch to restart Chrome.
🔧 Temporary Workarounds
Disable Safe Browsing
allTemporarily disable Safe Browsing feature to remove vulnerable component (not recommended for security).
chrome://settings/security
Toggle 'Safe Browsing' to off
🧯 If You Can't Patch
- Isolate vulnerable systems from untrusted networks and websites.
- Use application allowlisting to restrict browser execution to essential users only.
🔍 How to Verify
Check if Vulnerable:
Check Chrome version in Help > About Google Chrome. If version is below 141.0.7390.107, system is vulnerable.Check Version:
google-chrome --versionVerify Fix Applied:
Confirm Chrome version is 141.0.7390.107 or higher in About Google Chrome.📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with memory access violation errors
- Unusual process spawns from Chrome renderer processes
Network Indicators:
- Unusual outbound connections from Chrome processes
- Traffic to known exploit hosting domains
SIEM Query:
source="chrome" AND (event_type="crash" OR process_name="chrome.exe") AND memory_access_violation