CVE-2025-11460

HighCVSS 8.8/10Last modified Oct 7, 2026

Description

Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
Google	Chrome	>= 141.0.7390.65, < 141.0.7390.65

References

https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/446722008Issue Tracking, Permissions Required

Timeline

Published: Nov 6, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-114618.8Multiple SQL Injections in Frappe CRM Dashboard Controller due to unsafe concatenation of user-controlled parameters into dynamic SQL statem CVE-2025-114627.8Improper Link Resolution Before File Access in the AWS VPN Client for macOS versions 1.3.2- 5.2.0 allows a local user to execute code with e CVE-2025-114637.8Ashlar-Vellum Cobalt XE File Parsing Integer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attackers to exe CVE-2025-114647.8Ashlar-Vellum Cobalt CO File Parsing Heap-based Buffer Overflow Remote Code Execution Vulnerability. This vulnerability allows remote attack CVE-2025-114657.8Ashlar-Vellum Cobalt CO File Parsing Use-After-Free Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execu CVE-2025-114664.9Allegra DatabaseBackupBL Directory Traversal Information Disclosure Vulnerability. This vulnerability allows remote attackers to disclose se CVE-2025-114675.8The RSS Aggregator by Feedzy – Feed to Post, Autoblogging, News & YouTube Video Feeds Aggregator plugin for WordPress is vulnerable to Blind CVE-2025-114685.7When folding a long comment in an email header containing exclusively unfoldable characters, the parenthesis would not be preserved. This co CVE-2025-114699.8A weakness has been identified in SourceCodester Hotel and Lodge Management System 1.0. The affected element is an unknown function of the f CVE-2025-11475.3A vulnerability has been found in GNU Binutils 2.43 and classified as problematic. Affected by this vulnerability is the function __sanitize CVE-2025-114707.2A security vulnerability has been detected in SourceCodester Hotel and Lodge Management System up to 1.0. The impacted element is an unknown CVE-2025-114719.8A vulnerability was detected in SourceCodester Hotel and Lodge Management System 1.0. This affects an unknown function of the file /edit_cus