CVE-2025-12909
BaseFortify
Publication date: 2025-11-08
Last updated on: 2025-11-21
Assigner: Chrome
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| chrome | to 140.0.7339.80 (exc) |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-693 | The product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is due to insufficient policy enforcement in the Devtools feature of Google Chrome versions prior to 140.0.7339.80. It allows a remote attacker to leak cross-origin data via Devtools, meaning that data from one origin could be accessed by another unauthorized origin through the developer tools.
How can this vulnerability impact me? :
The impact of this vulnerability is that a remote attacker could potentially access and leak sensitive data from different origins through Chrome's Devtools. This could lead to unauthorized disclosure of information that should be isolated between different websites or web applications.