CVE-2025-11756
Published: 06 November 2025
Summary
CVE-2025-11756 is a high-severity Use After Free (CWE-416) vulnerability in Google Chrome. Its CVSS base score is 8.8 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Exploitation for Client Execution (T1203); ranked at the 29.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-16 (Memory Protection) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2025-11756 is a use-after-free vulnerability (CWE-416) in the Safe Browsing component of Google Chrome prior to version 141.0.7390.107. This flaw, published on 2025-11-06, carries a CVSS v3.1 base score of 8.8 and is rated High severity by Chromium security standards. It enables potential out-of-bounds memory access when triggered by a crafted HTML page.
A remote attacker who has already compromised the renderer process can exploit this vulnerability. The attack requires network access (AV:N), low attack complexity (AC:L), no privileges (PR:N), and user interaction (UI:R), with unchanged scope (S:U). Successful exploitation could result in high impacts to confidentiality, integrity, and availability (C:H/I:H/A:H).
Mitigation is available via the Google Chrome stable channel update to version 141.0.7390.107 or later, as announced in the Chrome Releases blog post and detailed in the associated Chromium issue tracker entry.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-38198
Vulnerability details
Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise TechniquesAI
Why these techniques?
Use-after-free vulnerability in Google Chrome renderer process, triggered by crafted HTML page, enables remote code execution in a client application.
CVEs Like This One
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely identification, reporting, and correction of flaws like this use-after-free vulnerability through software updates to Chrome version 141.0.7390.107 or later.
Implements memory protection mechanisms such as address space randomization and data execution prevention that comprehensively mitigate use-after-free exploits leading to out-of-bounds access.
Enforces process isolation for the renderer process, limiting the scope of damage from a compromised renderer even when exploited via crafted HTML.