CVE-2025-10501
Published: 24 September 2025
Summary
CVE-2025-10501 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Drive-by Compromise (T1189); ranked at the 35.3th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and RA-5 (Vulnerability Monitoring and Scanning).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Directly requires timely remediation of identified flaws such as the use-after-free vulnerability in Chrome's WebRTC by applying patches like version 140.0.7339.185.
Implements memory protection mechanisms that mitigate heap corruption from use-after-free exploits by restricting unauthorized memory access.
Enables vulnerability scanning to identify systems running vulnerable Google Chrome versions affected by CVE-2025-10501.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free in browser WebRTC component enables drive-by compromise via malicious HTML page and direct client-side exploitation for code execution.
NVD Description
Use after free in WebRTC in Google Chrome prior to 140.0.7339.185 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
Deeper analysisAI
CVE-2025-10501 is a use-after-free vulnerability (CWE-416) in the WebRTC component of Google Chrome prior to version 140.0.7339.185. Published on 2025-09-24, it allows a remote attacker to potentially exploit heap corruption via a crafted HTML page. Chromium security rates it as High severity, with a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H).
A remote attacker without privileges can exploit this by luring a user to interact with a malicious site, such as by visiting a crafted HTML page. Successful exploitation could lead to heap corruption, enabling high-impact effects on confidentiality, integrity, and availability, potentially including arbitrary code execution.
Mitigation is available via the Google Chrome stable channel update for desktop, announced at https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html. The issue is tracked at https://issues.chromium.org/issues/440737137. Security practitioners should ensure Chrome is updated to version 140.0.7339.185 or later.
Details
- CWE(s)