CVE-2025-8881
BaseFortify
Publication date: 2025-08-13
Last updated on: 2025-08-14
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 139.0.7258.127 (exc) | |
| apple | macos | * |
| microsoft | windows | * |
| linux | linux_kernel | From 5.15.160 (inc) to 5.16 (inc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-346 | The product does not properly verify that the source of data or communication is valid. |
| CWE-303 | The requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is an inappropriate implementation in the File Picker feature of Google Chrome versions prior to 139.0.7258.127. It allows a remote attacker to trick a user into performing specific user interface gestures, which then enables the attacker to leak cross-origin data through a specially crafted HTML page.
How can this vulnerability impact me? :
The vulnerability can lead to unauthorized disclosure of data from different origins, meaning an attacker could access sensitive information from other websites or services that the user has open, potentially compromising privacy and security.