CVE-2025-12440

Unknown Unknown - Not Provided

BaseFortify

Publication date: 2025-11-10

Last updated on: 2025-11-13

Assigner: Chrome

Description

Inappropriate implementation in Autofill in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-10

Last Modified

2025-11-13

Generated

2026-07-06

AI Q&A

2025-11-10

EPSS Evaluated

2026-07-05

NVD

CVE-2025-12440

EUVD

EUVD-2025-50795

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 142.0.7444.59 (exc)
apple	macos	*
linux	linux_kernel	*
microsoft	windows	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-120	The product copies an input buffer to an output buffer without verifying that the size of the input buffer is less than the size of the output buffer.

Attack-Flow Graph

Executive Summary

This vulnerability is due to an inappropriate implementation in the Autofill feature of Google Chrome versions prior to 142.0.7444.59. It allows a remote attacker to trick a user into performing specific UI gestures on a crafted HTML page, which then enables the attacker to access potentially sensitive information from the browser's process memory.

Impact Analysis

If exploited, this vulnerability could lead to unauthorized disclosure of sensitive information stored in the browser's memory, potentially compromising user privacy and security.

Mitigation Strategies

Update Google Chrome to version 142.0.7444.59 or later to fix the inappropriate Autofill implementation vulnerability.

Hi! I’m here to help you understand CVE-2025-12440. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70