Google releases update for Chrome multiple flaws
Take action: If you are using Google Chrome or other Chromium-based browsers (Edge, Brave, Vivaldi, Opera...) patch your browser ASAO. While not a critical zero-day emergency, these high-severity vulnerabilities deserve quick update. And updating is trivial, all your tabs reopen. Don't ignore or delay this.
Learn More
Google has released Chrome 141.0.7390.54 (Linux) and 141.0.7390.54/55 for Windows and Mac, patching multile vulnerabilities including high-severity heap buffer overflow flaws that could allow attackers to execute malicious code and crash browsers.
Vulnerabilities summary
- CVE-2025-11205 (CVSS 9.8, Google severity High) - Heap buffer overflow in WebGPU, potentially allowing attackers to execute arbitrary code or crash the browser through memory corruption exploitation. Google awarded researcher Atte Kettunen of OUSPG a $25,000 bug bounty for this discovery
- CVE-2025-11206 (CVSS 9.8, Google severity High) - Heap buffer overflow in Video, enabling attackers to manipulate video rendering processes to cause browser instability or crashes
- CVE-2025-11219 (CVSS 9.8, Google severity Low) - Use after free vulnerability in V8 JavaScript engine, discovered by Google's Big Sleep AI system
- CVE-2025-11208, CVE-2025-11212 (CVSS 9.8, Google severity Medium) - Inappropriate implementation vulnerabilities in Media system
- CVE-2025-11209, CVE-2025-11213 (CVSS 9.8, Google severity Medium) - Inappropriate implementation vulnerabilities in Omnibox functionality
- CVE-2025-11211 (CVSS 9.8, Google severity Medium) - Out of bounds read in Media
- CVE-2025-11215 (CVSS 9.1, Google severity Medium) - Off-by-one error in V8 JavaScript engine, discovered by Google's Big Sleep AI system
- CVE-2025-11207 (CVSS 7.5, Google severity Medium) - Side-channel information leakage in Storage, potentially allowing attackers to extract sensitive data through timing attacks
- CVE-2025-11210 (CVSS 7.5, Google severity Medium) - Side-channel information leakage in Tab functionality
Google paid out over $50,000 in bug bounty rewards to external security researchers who discovered these vulnerabilities. The company's security restricts access to detailed bug until most users receive the security patches.
Chrome users should update their browsers as soon as possible. The update will roll out gradually over the coming days and weeks through Chrome's automatic update mechanism. Users can manually check for updates by navigating to Chrome's settings menu and selecting "About Chrome."
