PT-2025-38316 · Google +3 · Google Chrome +4

Published 2025-01-01 · Updated 2025-12-16 · CVE-2025-10500

Positive Technologies · (AI Summary)

CVSS v3.1

8.8

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Chromium versions prior to 140.0.7339.185 Chromium versions 140.0.7339.185-1deb12u1 through 140.0.7339.185-1deb13u1 Chromium version 141.0.7390.76-alt0.p11.1

Description A use-after-free issue exists in Dawn within Google Chrome and Microsoft Edge. This flaw allows a remote attacker to potentially exploit heap corruption through a specially crafted HTML page. The vulnerability is related to the WebGPU component. Exploitation of this issue may allow an attacker to execute arbitrary code. Google is aware of an exploit for this issue being used in the wild.

Recommendations Upgrade Chromium to version 140.0.7339.185 or later. Upgrade Chromium to version 140.0.7339.185-1deb12u1 for Debian oldstable (bookworm). Upgrade Chromium to version 140.0.7339.185-1deb13u1 for Debian stable (trixie). Upgrade Chromium to version 141.0.7390.76-alt0.p11.1.

Fix

RCE

Use After Free

Weakness Enumeration

CWE-416

Related Identifiers

ALT-PU-2025-13054

BDU:2025-11453

CVE-2025-10500

DSA-6004-1

Affected Products

Alt Linux

Chromium

Debian

Google Chrome

Red Os

References · 28

• https://wiki.astralinux.ru/astra-linux-se18-bulletin-2025-1113SE18 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-10500 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se17-bulletin-2025-1202SE17 · Vendor Advisory
• https://wiki.astralinux.ru/astra-linux-se47-bulletin-2025-1216SE126 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop_17.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-11453 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2025-10500 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-10500 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-6004-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-10500 · Security Note
• https://t.me/cveNotify/136321 · Telegram Post
• https://t.me/msrcreports/2150 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1970938720569196589 · Twitter Post
• https://chromereleases.googleblog.com · Note