CVE-2025-10891

highpriority · track · 3EPSS 0.084 · 95 %ileDEEUFRRUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

8.39% (95th) EPSS

CVSS 8.8 · high

Is it mine?

20 products

Check your exposure

Who says so?

7 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-27

Integer overflow in V8 in Google Chrome prior to 140.0.7339.207 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedchromedriver-141.0.7390.76-bp160.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedchromedriver-141.0.7390.76-bp160.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedchromedriver-141.0.7390.76-bp160.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedchromium-141.0.7390.76-bp160.1.1.aarch64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedchromium-141.0.7390.76-bp160.1.1.ppc64le as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".
Fixedchromium-141.0.7390.76-bp160.1.1.x86_64 as component of openSUSE Leap 16.0suse_csaf
To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or "zypper patch".

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highAV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · FSTEC (BDU) RU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondary · ENISA EU

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:Hsecondaryexploitability 2.8 · impact 5.9

v3.18.1highCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-190USCWE-472USCWE-472US

affected products (20)

Products and version ranges known to be affected.

Debian Linuxall versionscert_bundDEcpe:/o:debian:debian_linux:-
Fedora Linuxall versionscert_bundDEcpe:/o:fedoraproject:fedora:-
Google Chrome <140.0.7339.208all versionscert_bundDE
Google Chrome linux <140.0.7339.207all versionscert_bundDE
Microsoft Edge <140.0.3485.94all versionscert_bundDE
SUSE openSUSEall versionscert_bundDEcpe:/o:suse:opensuse:-
Google Chrome≤ linux <140.0.7339.207cert_bundDE
Google Chrome< 140.0.7339.208cert_bundDE
Microsoft Edge< 140.0.3485.94cert_bundDE
Google Chrome140.0.7339.207 → 140.0.7339.207enisa_euvdEU
Google Inc Google Chrome≤ 140.0.7339.207fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 2.14fstec_bduRU
АО «НППКТ» ОСОН ОСнова Оnyx≤ 3.1fstec_bduRU
ООО «НЦПР» МСВСфера≤ 9.5fstec_bduRU
ООО «Ред Софт» РЕД ОС≤ 7.3fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Common Edition≤ 1.6 «Смоленск»fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 4.7fstec_bduRU
ООО «РусБИТех-Астра» Astra Linux Special Edition≤ 1.8fstec_bduRU
google chrome< 140.0.7339.207nvdUScpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*

advisories (3)

Vendor and ecosystem advisories describing this.

WID-SEC-W-2025-2117Google Chrome / Microsoft Edge: Mehrere SchwachstellenDeutsch2025-09-23csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Google Chrome / Microsoft Edge ausnutzen, um Informationen offenzulegen und Code auszuführen.
openSUSE-SU-2025:20020-1Security update for chromium2025-10-15csaf · suse_csafDE
Security update for chromium
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund nvd suse_csaf certfr NVD CVE.org MITRE

published 2025-09-24modified 2026-06-17

references (7)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan