cbcvebase.
CVE-2025-12436
published 2025-11-10

CVE-2025-12436: Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain…

PriorityP430medium5.9CVSS 3.1
AVNACHPRNUINSUCHINAN
EPSS
0.16%
6.0th percentile
Policy bypass in Extensions in Google Chrome prior to 142.0.7444.59 allowed an attacker who convinced a user to install a malicious extension to obtain potentially sensitive information from process memory via a crafted Chrome Extension. (Chromium security severity: Medium)

Affected

9 ranges
VendorProductVersion rangeFixed in
chromiumchromium>= 0 < 142.0.7444.59-1~deb12u1142.0.7444.59-1~deb12u1
chromiumchromium>= 0 < 142.0.7444.59-1~deb13u1142.0.7444.59-1~deb13u1
chromiumchromium>= 0 < 142.0.7444.59-1142.0.7444.59-1
debianchromium< chromium 142.0.7444.59-1~deb12u1 (bookworm)chromium 142.0.7444.59-1~deb12u1 (bookworm)
googlechrome< 142.0.7444.59142.0.7444.59
googlechrome>= 142.0.7444.59 < 142.0.7444.59142.0.7444.59
googlechrome_chrome——
msrcmicrosoft_edge——
paloaltoprisma_browser——

CVSS provenance

nvdv3.15.9MEDIUMCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
osv5.9MEDIUM
vendor_debian5.9MEDIUM
vendor_msrc5.9MEDIUM
vendor_redhat5.9MEDIUM
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.