CVE-2025-12431 — Authentication Bypass Using an Alternate Path or Channel in Google Chrome
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 95.83%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedNov 10
Latest updateNov 12
Description
Inappropriate implementation in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to bypass navigation restrictions via a crafted Chrome Extension. (Chromium security severity: High)
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:NExploitability: 3.9 | Impact: 2.5
Affected Packages4 packages
🔴Vulnerability Details
3GHSA▶
GHSA-3p2j-4mpr-385w: Inappropriate implementation in Extensions in Google Chrome prior to 142↗2025-11-10
CVEList
▶
OSV
▶