CVE-2025-12439
published 2025-11-10CVE-2025-12439: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially…
PriorityP422medium5.5CVSS 3.1
AVLACLPRNUIRSUCHINAN
EPSS
0.08%
0.3th percentile
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| chromium | chromium | >= 0 < 142.0.7444.59-1~deb12u1 | 142.0.7444.59-1~deb12u1 |
| chromium | chromium | >= 0 < 142.0.7444.59-1~deb13u1 | 142.0.7444.59-1~deb13u1 |
| chromium | chromium | >= 0 < 142.0.7444.59-1 | 142.0.7444.59-1 |
| debian | chromium | < chromium 142.0.7444.59-1~deb12u1 (bookworm) | chromium 142.0.7444.59-1~deb12u1 (bookworm) |
| chrome | < 142.0.7444.59 | 142.0.7444.59 | |
| chrome | >= 142.0.7444.59 < 142.0.7444.59 | 142.0.7444.59 | |
| msrc | cbl_mariner_1.0_arm | — | — |
| msrc | cbl_mariner_1.0_x64 | — | — |
| msrc | cm1_bubblewrap_0.3.0-5_on_cbl_mariner_1.0 | — | — |
| msrc | microsoft_edge | — | — |
| paloalto | prisma_browser | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
osv5.5MEDIUM
vendor_msrc7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
CVE-2025-12439: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142
osv·2025-11-10·CVSS 5.5
CVE-2025-12439 [MEDIUM] CVE-2025-12439: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
GHSA
GHSA-3r87-4xwq-xh86: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142
ghsa_unreviewed·2025-11-10
CVE-2025-12439 [MEDIUM] CWE-326 GHSA-3r87-4xwq-xh86: Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
Palo Alto
PAN-SA-2025-0018 Chromium and Prisma Browser: Monthly Vulnerability Update (November 2025)
vendor_paloalto·2025-11-12·CVSS 8.8
CVE-2025-12428 [HIGH] PAN-SA-2025-0018 Chromium and Prisma Browser: Monthly Vulnerability Update (November 2025)
PAN-SA-2025-0018 Chromium and Prisma Browser: Monthly Vulnerability Update (November 2025)
Palo Alto Networks incorporated the following Chromium security fixes into our products: https://chromereleases.googleblog.com/2025/10/stable-channel-update-for-desktop_28.html CVE CVSS Summary CVE-2025-12428 Type Confusion in V8 CVE-2025-12429 Inappropriate implementation in V8 CVE-2025-12430 Object lifecycle issue in Media CVE-2025-12431 Inappropriate implementation in Extensions CVE-2025-12432 Race in V8 CVE-2025-12433 Inappropriate implementation in V8 CVE-2025-12036 Inappropriate implementation in V8 CVE-2025-12434 Race in Storage CVE-2025-12435 Incorrect security UI in Omnibox CVE-2025-12436 Policy bypass in Extensions CVE-2025-12437 Use after free in PageInfo CVE-2025-12438 Use after free in
Red Hat
chromium-browser: Inappropriate implementation in App-Bound Encryption
vendor_redhat·2025-11-10·CVSS 5.5
CVE-2025-12439 [MEDIUM] CWE-524 chromium-browser: Inappropriate implementation in App-Bound Encryption
chromium-browser: Inappropriate implementation in App-Bound Encryption
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
Statement: Red Hat Product Security rates the severity of this flaw as determined by the Google Chrome Security Advisory.
Microsoft
Chromium: CVE-2025-12439 Inappropriate implementation in App-Bound Encryption
vendor_msrc·2025-10-14·CVSS 5.5
CVE-2025-12439 [MEDIUM] Chromium: CVE-2025-12439 Inappropriate implementation in App-Bound Encryption
Chromium: CVE-2025-12439 Inappropriate implementation in App-Bound Encryption
Description: This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
FAQ: What is the version information for this release?
Microsoft Edge Version
Date Released
Based on Chromium Version
142.0.3595.53
10/31/2025
142.0.7445.59/.60
FAQ: Why is this Chrome CVE included in the Security Update Guide?
The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.
How can I see t
Debian
CVE-2025-12439: chromium - Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows...
vendor_debian·2025·CVSS 5.5
CVE-2025-12439 [MEDIUM] CVE-2025-12439: chromium - Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows...
Inappropriate implementation in App-Bound Encryption in Google Chrome on Windows prior to 142.0.7444.59 allowed a local attacker to obtain potentially sensitive information from process memory via a malicious file. (Chromium security severity: Medium)
Scope: local
bookworm: resolved (fixed in 142.0.7444.59-1~deb12u1)
bullseye: open
forky: resolved (fixed in 142.0.7444.59-1)
sid: resolved (fixed in 142.0.7444.59-1)
trixie: resolved (fixed in 142.0.7444.59-1~deb13u1)
Microsoft
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR) a local attacker may abuse this flaw to p
vendor_msrc·2019-05-14·CVSS 7.8
CVE-2019-12439 [HIGH] CWE-20 bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR) a local attacker may abuse this flaw to p
bubblewrap.c in Bubblewrap before 0.3.3 misuses temporary directories in /tmp as a mount point. In some particular configurations (related to XDG_RUNTIME_DIR) a local attacker may abuse this flaw to prevent other users from executing bubblewrap or potentially execute code.
FAQ: Is Azure Linux the only Microsoft product that includes this open-source library and is therefore potentially affected by this vulnerability?
One of the main benefits to our customers who choose to use the Azure Linux distro is the commitment to keep it up to date with the most recent and most secure versions of the open source libraries with which the distro is composed. Microsoft is committed to transparency in this work which is why we began publishing CSAF/VEX in October 2025. See this blog post for more inform
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2025-11-10
Published