BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-13

Assigner: Chrome

Description

Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-13

Generated

2026-07-06

AI Q&A

2025-11-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12439

EUVD

EUVD-2025-50796

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 142.0.7444.59 (exc)
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-326	The product stores or transmits sensitive data using an encryption scheme that is theoretically sound, but is not strong enough for the level of protection required.

Attack-Flow Graph

Executive Summary

This vulnerability is due to an inappropriate implementation of App-Bound Encryption in Google Chrome on Windows versions prior to 142.0.7444.59. It allows a local attacker to obtain potentially sensitive information from the process memory by using a malicious file.

Impact Analysis

The vulnerability can impact you by allowing a local attacker to access potentially sensitive information stored in the process memory of Google Chrome, which could lead to information disclosure.

Hi! I’m here to help you understand CVE-2025-12439. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70