Cyber Posture

CVE-2025-11460

High

Published: 06 November 2025

Published
06 November 2025
Modified
25 November 2025
KEV Added
Patch
CVSS Score 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.0011 29.0th percentile
Risk Priority 18 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2025-11460 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).

Threat & Defense at a Glance

What attackers do: exploitation maps to Exploitation for Client Execution (T1203). What defenders deploy: see the NIST 800-53 controls recommended below.
Threat & Defense Details

Mitigating Controls (NIST 800-53 r5)AI

prevent

Mandates timely identification, reporting, and correction of flaws like the use-after-free in Chrome's Storage component by applying patches such as version 141.0.7390.65.

prevent

Implements memory protection mechanisms like ASLR, DEP, and sandboxing that mitigate exploitation of use-after-free vulnerabilities during crafted video file processing.

detect

Requires vulnerability scanning to identify systems running vulnerable Chrome versions prior to 141.0.7390.65 affected by this use-after-free issue.

MITRE ATT&CK Enterprise TechniquesAI

T1203 Exploitation for Client Execution Execution
Adversaries may exploit software vulnerabilities in client applications to execute code.
Why these techniques?

The vulnerability is a use-after-free in Chrome's Storage component exploitable via a crafted video file, enabling arbitrary code execution in a client application, directly mapping to Exploitation for Client Execution (T1203).

Confidence: HIGH · MITRE ATT&CK Enterprise v19.0

NVD Description

Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)

Deeper analysisAI

CVE-2025-11460 is a use-after-free vulnerability (CWE-416) in the Storage component of Google Chrome versions prior to 141.0.7390.65. It allows a remote attacker to execute arbitrary code by processing a crafted video file. The vulnerability carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.

A remote attacker can exploit this vulnerability over the network with low complexity and no required privileges, though user interaction is necessary, such as convincing a user to open a malicious video file in Chrome. Successful exploitation enables arbitrary code execution within the context of the browser, potentially leading to full compromise of the affected system.

Mitigation involves updating to Google Chrome version 141.0.7390.65 or later, as detailed in the Chrome stable channel release notes at https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop.html and the associated Chromium issue tracker at https://issues.chromium.org/issues/446722008.

Details

CWE(s)

Affected Products

google
chrome
≤ 141.0.7390.65

CVEs Like This One

CVE-2026-5860Same product: Apple Macos
CVE-2026-7349Same product: Apple Macos
CVE-2026-3923Same product: Apple Macos
CVE-2025-11756Same product: Apple Macos
CVE-2026-3921Same product: Apple Macos
CVE-2025-8578Same product: Apple Macos
CVE-2026-7338Same product: Apple Macos
CVE-2026-6316Same product: Apple Macos
CVE-2026-2321Same product: Apple Macos
CVE-2026-3919Same product: Apple Macos

References