Introduction
A remote attacker who lured a user to a malicious web page could corrupt the heap and potentially execute arbitrary code, and the exposure reached billions of Chrome browsers. The flaw, tracked as CVE-2025-10891, is an integer overflow in Google Chrome's V8 JavaScript engine. It is one more case of the memory safety flaws that keep turning up in widely deployed browser runtimes.
Technical Information
CVE-2025-10891 is an integer overflow vulnerability in the V8 JavaScript engine, the engine behind Google Chrome and other Chromium-based browsers. The overflow happens when arithmetic on user-supplied input produces a result larger than the underlying integer type can represent. The calculation can then wrap around, and the wrong value ends up in a memory allocation or an array index.
In V8, such an overflow may corrupt heap memory structures if an attacker-controlled value is used to calculate, for example, the size of a memory allocation or an array index. A remote attacker can trigger the overflow with specially crafted JavaScript embedded in an HTML page. Successful exploitation can corrupt the heap, and an attacker may be able to use that corruption to execute arbitrary code in the context of the browser process.
Google's Big Sleep AI system, which systematically analyzes large codebases for security flaws, found the vulnerability. The root cause is that V8 did not apply comprehensive bounds checking to certain arithmetic operations. The fix adds strict bounds checks to those operations so values cannot exceed their intended limits.
No public code snippets or exploit samples have been released as of this writing.
Patch Information
The latest Chrome update, version 140.0.7339.207/.208, fixes three significant security vulnerabilities in the V8 JavaScript engine:
-
Side-Channel Information Leakage (CVE-2025-10890): Attackers could infer sensitive information through side-channel attacks. The patch adds stricter isolation between processes to prevent data leakage through shared resources.
-
Integer Overflow (CVE-2025-10891): An integer overflow in V8 could lead to memory corruption and potential code execution. The fix adds comprehensive bounds checking to arithmetic operations so values cannot exceed their intended limits.
-
Integer Overflow (CVE-2025-10892): Another integer overflow in V8, similar to the previous issue. The fix includes stronger validation of input data and safe integer handling practices that prevent overflow conditions.
Patch source: Google Chrome Release Blog
Affected Systems and Versions
- Google Chrome for Windows and Mac: All versions prior to 140.0.7339.207 and 140.0.7339.208
- Google Chrome for Linux: All versions prior to 140.0.7339.207
- Only Chrome versions before these releases are vulnerable. Chrome 140.0.7339.207 and later are not affected.
Vendor Security History
Google Chrome's V8 engine has had multiple high-severity vulnerabilities before, many of them memory safety bugs such as type confusion, use-after-free, and integer overflow. Google has a strong track record of fast response and often releases patches within days of discovery. Its use of AI-driven research through Big Sleep, alongside the established work of Project Zero, points to a mature and proactive security program. Earlier vulnerabilities of this kind were also fixed quickly, which kept exposure windows short for users.
References
- NVD Entry for CVE-2025-10891
- Official CVE Entry
- Google Chrome Release Blog
- Chromium Issue Tracker
- SecurityOnline.info: Google Chrome patches three high-severity flaws in V8 engine
- GBHackers: Chrome High Severity Flaws
- Malware News: Google Chrome Security Advisory
- Cybersecurity Help: Advisory
- Cybersecurity Help: Vulnerability Details
