Chrome Use-After-Free Flaw Lets Attackers Execute Arbitrary Code

Google has released a fix for a critical use-after-free vulnerability in Chrome’s Safe Browsing feature, tracked as CVE-2025-11756, which could allow attackers to execute arbitrary code on a victim’s computer. The flaw was discovered in Safe Browsing and reported by security researcher asnine on September 25, 2025, earning a $7,000 bounty from Google’s bug bounty program.

When exploited, the vulnerability could enable malware installation, data theft, or unauthorized access to the affected system, with Safe Browsing running with elevated privileges to protect users from online threats. Chrome version 141.0.7390.107/.108 for Windows and Mac, and 141.0.7390.107 for Linux, were released as the fixed versions, with rollout beginning on 14 October 2025 and continuing over the coming days and weeks; users are advised to update promptly.

Google’s security team employed tools such as AddressSanitizer, MemorySanitizer and other fuzzing methods to identify and mitigate similar issues before they reached stable releases. The disclosure policy restricts detailed bug information until most users have installed the patch, in order to reduce exploitation risks.