Google has released an urgent security update for its Chrome browser , addressing a high - severity use-after-free vulnerability that could allow attackers to execute arbitrary code on users' systems.
The flaw, tracked as CVE-2025-11756, is in Safe Browsing Chrome's, a key component designed to protect users from malicious websites and phishing attempts. It was discovered by independent researcher “as nine” on September 25, 2025, and earned him a $7,000 bounty under Google's Vulnerability Reward Program.
See also: Microsoft Patch Tuesday October 2025: 172 vulnerabilities fixed
The patch is included in version 141.0.7390.107 for Linux and 141.0.7390.107/.108 for Windows and macOS. The full release notes detail the changes, with the update expected to reach most users in the coming days or weeks.
Google Chrome: Use-after-free vulnerability
Use-after-free bugs can lead to crashes, data corruption, or exploitation. In this case, attackers could exploit the Chrome bug to inject and execute malicious code, bypassing security sandboxes and compromising the entire browser environment.
See also: Vulnerability in FortiPAM and FortiSwitch Manager bypasses verification process
Google classifies the issue as high severity, highlighting the potential for remote exploitation without user interaction. Simply visiting a compromised web page could trigger the attack. While no exploits have been widely reported, the company limited the details of the bug to ensure that most users receive the update. This is in line with Chrome's proactive security stance, where access to full disclosures is often delayed until updates are rolled out.
See also: Zero-day exploit in Windows Remote Access Connection Manager
The fix was powered by suite of detection tools Google's, including AddressSanitizer, MemorySanitizer, and libFuzzer, which help detect memory-related bugs. Google also expressed its gratitude to external researchers for their contributions to early bug detection.
Users should update Chrome immediately through the browser's settings menu or through automatic rollout. As browser-based threats evolve, this incident highlights the importance of timely patching to defend against sophisticated attacks.
