CVE-2025-11206CWE-122CWE-787

CVE-2025-11206

High · published November 7, 2025

CVSS v3.1
7.1
EPSS
0%
Percentile
12.5
In the wild
Unconfirmed
What it is

🚨 A crafty crafted HTML page can lead to a heap buffer overflow in Google Chrome! That’s a ticket to potentially escape the sandbox! 🔥 Think of it like a sneaky magician getting a hold of the key to the backstage area, allowing them to access parts of the show that should be off-limits. This vulnerability lets the attacker bypass the browser's security barrier and run wild! An attacker could exploit this flaw to execute arbitrary code outside the browser’s sandbox, potentially compromising the entire system. The consequences could range from data theft to full system takeover — a real nightmare for users! ⚡

Put simply

Think of it like a sneaky magician getting a hold of the key to the backstage area, allowing them to access parts of the show that should be off-limits. This vulnerability lets the attacker bypass the browser's security barrier and run wild! This heap buffer overflow vulnerability in Google Chrome allows a remote attacker to craft a malicious HTML page that, when opened, can trigger unexpected behavior and escape sandbox restrictions.

What to do

An attacker could exploit this flaw to execute arbitrary code outside the browser’s sandbox, potentially compromising the entire system. The consequences could range from data theft to full system takeover — a real nightmare for users! ⚡ To protect yourself, update Google Chrome to version 141.0.7390.54 or later immediately. It’s also wise to review any security settings and practices to ensure maximum protection against such vulnerabilities. 🛡️ You've got this! Keep your browser updated, and you'll stay one step ahead of the attackers! 🚀

The record
Technical detail
CVSS v3.1
7.1 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00226 · 12.5th percentile
Weaknesses
CWE-122 · Heap-based Buffer Overflow; CWE-787 · Out-of-bounds Write
Published
2025-11-07T03:15Z
Affected products (1)
ProductVersionsFixed in
google/chrome< 141.0.7390.54141.0.7390.54
References (2)
EPSS history
Timeline
  • 06 NOV 22:08Z
    Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page
    cvelistv5