Multiple Google Chrome Flaws Allow Attackers to Execute Arbitrary Code

According to Google’s vulnerability disclosure program, Google rolled out Chrome version 141.0.7390.65/.66 for Windows and Mac, with 141.0.7390.65 for Linux, addressing three critical memory-handling flaws that could allow an attacker to execute arbitrary code in the browser. The vulnerabilities include CVE-2025-11458, a high-severity heap buffer overflow in Chrome Sync; CVE-2025-11460, a high-severity use-after-free in Storage; and CVE-2025-11211, a medium-severity out-of-bounds read in WebCodecs.

External researchers identified and reported these issues, with rewards ranging from 3,000 to 5,000 dollars depending on severity and complexity; the first flaw earned 5,000 dollars for Raven at KunLun Lab, reported on 5 September 2025, and Jakob Košir reported the third issue on 29 August 2025, earning 3,000 dollars. All three flaws require a user to visit or interact with specially crafted content, and Google urges immediate updating to safeguard systems.