PT-2025-29592 · Google+4 · Google Chrome+4

Jakebiles · Published 2025-06-25 · Updated 2025-10-09 · CVE-2025-7657

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 138.0.7204.157 Microsoft Edge (Chromium-based) versions prior to 138.0.7204.157 Chromium versions prior to 138.0.7204.157

Description A use-after-free issue exists in the WebRTC component of Google Chrome and Chromium-based browsers. This flaw allows a remote attacker to potentially exploit heap corruption by crafting a malicious HTML page. Exploitation of this issue may lead to denial of service or arbitrary code execution. The vulnerability is related to memory usage after it has been freed. Reports indicate a proof-of-concept (PoC) exploit is available.

Recommendations Update Google Chrome to version 138.0.7204.157 or later. Update Microsoft Edge (Chromium-based) to version 138.0.7204.157 or later. Update Chromium to version 138.0.7204.157 or later.

Fix

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2025-9770

BDU:2025-08879

CVE-2025-7657

DSA-5963-1

OPENSUSE-SU-2025:15350-1

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Red Os

References · 37

• https://osv.dev/vulnerability/DSA-5963-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-7657 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/723298 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-7657 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/723289 · Security Note
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-0904SE18MD · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-7657 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2025-7657 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15350-1 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/722691 · Security Note
• https://bdu.fstec.ru/vul/2025-08879 · Security Note