BaseFortify

Publication date: 2025-12-03

Last updated on: 2025-12-05

Assigner: Chrome

Description

Side-channel information leakage in Navigation and Loading in Google Chrome prior to 139.0.7258.66 allowed a remote attacker to bypass site isolation via a crafted HTML page. (Chromium security severity: Medium)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-03

Last Modified

2025-12-05

Generated

2026-07-06

AI Q&A

2025-12-03

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13992

EUVD

EUVD-2025-201092

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 139.0.7258.66 (exc)
apple	macos	*
microsoft	windows	*
linux	linux_kernel	From 5.15.160 (inc) to 5.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1300	The device does not contain sufficient protection mechanisms to prevent physical side channels from exposing sensitive information due to patterns in physically observable phenomena such as variations in power consumption, electromagnetic emissions (EME), or acoustic emissions.

Attack-Flow Graph

Executive Summary

This vulnerability is a side-channel information leakage in the Navigation and Loading components of Google Chrome versions prior to 139.0.7258.66. It allows a remote attacker to bypass site isolation by using a specially crafted HTML page, potentially exposing information that should be isolated between sites.

Impact Analysis

The vulnerability can allow a remote attacker to bypass site isolation in Google Chrome, which may lead to unauthorized access to sensitive information from other websites or browser contexts that are supposed to be isolated. This could result in data leakage or compromise of user privacy.

Hi! I’m here to help you understand CVE-2025-13992. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70