Google releases Chrome 141, patches multiple vulnerabilities enabling arbitrary code execution
Take action: If you are using Google Chrome or other Chromium-based browsers (Edge, Brave, Vivaldi, Opera...) patch your browser ASAP. While not a critical zero-day emergency, three vulnerabilities, two high-severity deserve quick update. And updating is trivial, all your tabs reopen.
Learn More
Google has released Chrome version 141.0.7390.65/.66 for Windows and Mac, and version 141.0.7390.65 for Linux, patching multiple high-severity and two critical (per CVSS score) memory handling vulnerabilities that could enable attackers to execute arbitrary code.
Vulnerabilities summary:
- CVE-2025-11460 (CVSS score 9.8, Google severity High), is a use-after-free condition in Chrome's Storage component. Attackers could exploit this flaw to cause the browser to access freed memory regions, leading to memory corruption, information leakage from deallocated memory, or potentially arbitrary code execution if the freed memory is reallocated with attacker-controlled data.
- CVE-2025-11458 (CVSS score 8.8, Google severity High), is a heap buffer overflow in Chrome's Sync component. Successful exploitation could trigger memory corruption leading to browser crashes, information disclosure, or potentially arbitrary code execution within the browser's process context.
- CVE-2025-11211 (CVSS score 9.8, Google severity Medium), is an out-of-bounds read in the WebCodecs API. The vulnerability could be exploited through malicious media files or malformed input parameters passed to WebCodecs API calls during encoding or decoding operations. Successful exploitation could still result in information disclosure through leaked memory contents, denial-of-service conditions through browser crashes, or serve as a component in more complex exploit chains combined with other vulnerabilities.
Affected versions of Google Chrome are
- All Google Chrome versions prior to 141.0.7390.65 for Linux
- All Google Chrome versions prior to 141.0.7390.65/.66 for Windows and Mac
Patched versions
- Google Chrome version 141.0.7390.65/.66 and all later versions for Windows and Mac
- Google Chrome version 141.0.7390.65 and all later versions for Linux
Chrome users should update their browsers immediately to the latest version to protect against these vulnerabilities. The browser typically updates automatically, but users can manually trigger an update by navigating to Settings → Help → About Google Chrome, which will check for and install the latest version if available.
