Chrome 141 Stable Fixes Two High-Severity Flaws: Heap Overflow in Sync and UAF in Storage

Google has released a Stable Channel update for Chrome 141.0.7390.65/66 on Windows and macOS and 141.0.7390.65 for Linux, addressing three high-severity vulnerabilities that could allow memory-related exploits or data exposure. The first, CVE-2025-11458, is a heap buffer overflow in Chrome’s Sync component reported by raven of KunLun Lab on 5 September 2025, and according to Google’s Vulnerability Rewards Program, earned a $5,000 reward.

The second, CVE-2025-11460, is a use-after-free flaw in Chrome’s Storage component reported by an independent researcher known as Sombra on 23 September 2025, with the reward amount yet to be determined. The third fix, CVE-2025-11211, is a medium-severity out-of-bounds read in WebCodecs reported by Jakob Košir on 29 August 2025, and awarded a $3,000 bounty. Users are urged to update by going to Settings → Help → About Google Chrome to ensure they’re protected.