PT-2025-31358 · Google+4 · Google Chrome+4

Zhiniang Peng · Published 2025-06-19 · Updated 2025-11-10 · CVE-2025-8292

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Chromium versions prior to 138.0.7204.183 Google Chrome versions prior to 138.0.7204.183 Microsoft Edge (Chromium-based) versions prior to 138.0.7204.183 openSUSE SLE-15-SP6 Fedora 41 and 42

Description A use-after-free issue exists in the Media Stream component of Chromium-based browsers, including Google Chrome and Microsoft Edge. This flaw allows a remote attacker to potentially exploit heap corruption by crafting a malicious HTML page. Exploitation of this issue could lead to arbitrary code execution, denial of service, or information disclosure. The vulnerability is related to accessing pointers to SpeechRecognitionMediaStreamAudioSinks after they have been destroyed. Multiple sources indicate this is a high-severity issue.

Recommendations Chromium versions prior to 138.0.7204.183: Upgrade to version 138.0.7204.183 or later. Google Chrome versions prior to 138.0.7204.183: Upgrade to version 138.0.7204.183 or later. Microsoft Edge (Chromium-based) versions prior to 138.0.7204.183: Upgrade to version 138.0.7204.183 or later. openSUSE SLE-15-SP6: Apply the available patch for CVE-2025-8292. Fedora 41: Use the command sudo dnf upgrade to apply the update. Fedora 42: Use the command dnf upgrade --advisory FEDORA-2025-2d776e48e1 to apply the update.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2025-10850

BDU:2025-09421

CVE-2025-8292

DSA-5968-1

OPENSUSE-SU-2025:15399-1

Affected Products

Alt Linux

Astra Linux

Debian

Google Chrome

Red Os

References · 47

• https://osv.dev/vulnerability/CVE-2025-8292 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-8292 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1020SE47 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-0923SE17 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-09421 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-8292 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-8292 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se16-bulletin-20251225SE16 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5968-1 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15399-1 · Vendor Advisory
• https://twitter.com/stooee_/status/1953169300195344846 · Twitter Post
• https://twitter.com/stooee_/status/1953894073422553220 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1950489697815261314 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-8292 · Note