CVE-2025-11460
Published: 06 November 2025
Summary
CVE-2025-11460 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 29.0th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 RA-5 (Vulnerability Monitoring and Scanning) and SI-2 (Flaw Remediation).
Threat & Defense at a Glance
Threat & Defense Details
Mitigating Controls (NIST 800-53 r5)AI
Mandates timely identification, reporting, and correction of flaws like the use-after-free in Chrome's Storage component by applying patches such as version 141.0.7390.65.
Implements memory protection mechanisms like ASLR, DEP, and sandboxing that mitigate exploitation of use-after-free vulnerabilities during crafted video file processing.
Requires vulnerability scanning to identify systems running vulnerable Chrome versions prior to 141.0.7390.65 affected by this use-after-free issue.
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
The vulnerability is a use-after-free in Chrome's Storage component exploitable via a crafted video file, enabling arbitrary code execution in a client application, directly mapping to Exploitation for Client Execution (T1203).
NVD Description
Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)
Deeper analysisAI
CVE-2025-11460 is a use-after-free vulnerability (CWE-416) in the Storage component of Google Chrome versions prior to 141.0.7390.65. It allows a remote attacker to execute arbitrary code by processing a crafted video file. The vulnerability carries a Chromium security severity rating of High and a CVSS v3.1 base score of 8.8 (AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H), indicating high confidentiality, integrity, and availability impacts.
A remote attacker can exploit this vulnerability over the network with low complexity and no required privileges, though user interaction is necessary, such as convincing a user to open a malicious video file in Chrome. Successful exploitation enables arbitrary code execution within the context of the browser, potentially leading to full compromise of the affected system.
Mitigation involves updating to Google Chrome version 141.0.7390.65 or later, as detailed in the Chrome stable channel release notes at https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop.html and the associated Chromium issue tracker at https://issues.chromium.org/issues/446722008.
Details
- CWE(s)