CVE-2025-8581
Unknown
Unknown - Not Provided
BaseFortify
Publication date: 2025-08-07
Last updated on: 2025-08-08
Assigner: Chrome
Description
Description
Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
| chrome | to 139.0.7258.66 (exc) | |
| apple | macos | * |
| microsoft | windows | * |
Helpful Resources
Exploitability
CWE
KEV
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to an inappropriate implementation in the Extensions feature of Google Chrome versions prior to 139.0.7258.66. It allows a remote attacker to trick a user into performing specific UI gestures, which then enables the attacker to leak cross-origin data through a specially crafted HTML page.
How can this vulnerability impact me? :
If exploited, this vulnerability can lead to unauthorized disclosure of data from different origins, potentially exposing sensitive information to attackers without proper authorization.
Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70