CVE-2025-3069 — Improperly Implemented Security Check for Standard in Google Chrome

CWE-358 — Improperly Implemented Security Check for Standard CWE-20 — Improper Input Validation11 documents10 sources

Severity

8.8HIGHNVD

EPSS

0.2%

top 51.84%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Paloalto Prisma Browser

Timeline

PublishedApr 2

Latest updateMay 14

Description

Inappropriate implementation in Extensions in Google Chrome prior to 135.0.7049.52 allowed a remote attacker to perform privilege escalation via a crafted HTML page. (Chromium security severity: Medium)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5google/chrome135.0.7049.52 — 135.0.7049.52

▶NVDgoogle/chrome< 135.0.7049.52

▶Debianchromium/chromium< 135.0.7049.52-1~deb12u1+2

▶Palo Altopaloalto/prisma_browser

🔴Vulnerability Details

CVEList

CVE-2025-3069: Inappropriate implementation in Extensions in Google Chrome prior to 135↗2025-04-02

▶

OSV

CVE-2025-3069: Inappropriate implementation in Extensions in Google Chrome prior to 135↗2025-04-02

▶

GHSA

GHSA-xhmh-cq7j-qhjr: Inappropriate implementation in Extensions in Google Chrome prior to 135↗2025-04-02

▶

📋Vendor Advisories

Palo Alto

PAN-SA-2025-0009 Chromium: Monthly Vulnerability Update (May 2025)↗2025-05-14

▶

Red Hat

kernel: drm/xe/vf: Don't try to trigger a full GT reset if VF↗2025-05-01

▶

Chrome

Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-3069↗2025-04-17

▶

Microsoft

Chromium: CVE-2025-3069 Inappropriate implementation in Extensions↗2025-04-08

▶

Chrome

Stable Channel Update for Desktop: CVE-2025-3067↗2025-04-01

▶

🕵️Threat Intelligence

Bleepingcomputer

Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws↗2025-04-08

▶