CVE-2025-1916
📋 TL;DR
A use-after-free vulnerability in Google Chrome's Profiles component allows attackers to potentially exploit heap corruption. This affects users who install malicious extensions and visit crafted HTML pages. The vulnerability enables arbitrary code execution with the privileges of the Chrome process.
💻 Affected Systems
- Google Chrome
- Chromium-based browsers
📦 What is this software?
Chrome by Google
Google Chrome is the world's most popular web browser, used by over 3 billion users globally across Windows, macOS, Linux, Android, and iOS platforms. As a Chromium-based browser developed by Google, Chrome dominates the browser market with approximately 65% market share, making it a critical compon...
Learn more about Chrome →⚠️ Risk & Real-World Impact
Worst Case
Full system compromise through remote code execution, allowing attackers to install malware, steal data, or pivot to other systems.
Likely Case
Browser compromise leading to session hijacking, credential theft, and installation of additional malicious extensions.
If Mitigated
Limited impact if extensions are restricted and users avoid suspicious websites, though heap corruption could still cause crashes.
🎯 Exploit Status
Exploitation requires social engineering to install malicious extension and visit malicious page.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 134.0.6998.35 and later
Vendor Advisory: https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html
Restart Required: No
Instructions:
1. Open Chrome menu > Help > About Google Chrome. 2. Chrome will automatically check for updates and install if available. 3. Relaunch Chrome when prompted.
🔧 Temporary Workarounds
Restrict Extension Installation
allConfigure Chrome policies to restrict extension installation to approved sources only.
For enterprise: Configure ExtensionInstallBlocklist/ExtensionInstallAllowlist via GPO or MDM
Disable Unnecessary Extensions
allRemove or disable extensions not required for business functions.
chrome://extensions/ > Toggle off or remove suspicious extensions
🧯 If You Can't Patch
- Implement network filtering to block malicious domains and restrict extension installation
- Use application allowlisting to prevent execution of unauthorized binaries
🔍 How to Verify
Check if Vulnerable:
Check Chrome version via chrome://settings/help or chrome://versionCheck Version:
On command line: google-chrome --version (Linux) or check About Google Chrome in browserVerify Fix Applied:
Confirm version is 134.0.6998.35 or higher📡 Detection & Monitoring
Log Indicators:
- Chrome crash reports with memory corruption signatures
- Unexpected extension installation events
- Suspicious process spawning from Chrome
Network Indicators:
- Connections to known malicious domains hosting crafted HTML
- Unusual outbound traffic patterns from Chrome processes
SIEM Query:
source="chrome_logs" AND (event="crash" OR event="extension_install") AND version<"134.0.6998.35"