Google Chrome vulnerabilities

CVE-2025-12444 [MEDIUM] CWE-306 CVE-2025-12444: Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote atta Incorrect security UI in Fullscreen UI in Google Chrome prior to 142.0.7444.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12907 [HIGH] CWE-20 CVE-2025-12907: Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allow Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools. (Chromium security severity: Low)

CVE-2025-12905 [MEDIUM] CWE-346 CVE-2025-12905: Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12910 [MEDIUM] CWE-1295 CVE-2025-12910: Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local att Inappropriate implementation in Passkeys in Google Chrome prior to 140.0.7339.80 allowed a local attacker to obtain potentially sensitive information via debug logs. (Chromium security severity: Low)

CVE-2025-12908 [MEDIUM] CWE-20 CVE-2025-12908: Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7 Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12911 [MEDIUM] CWE-451 CVE-2025-12911: Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12906 [MEDIUM] CWE-693 CVE-2025-12906: Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVE-2025-12909 [MEDIUM] CWE-693 CVE-2025-12909: Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)

CVE-2025-11458 [HIGH] CWE-122 CVE-2025-11458: Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to pe Heap buffer overflow in Sync in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11460 [HIGH] CWE-416 CVE-2025-11460: Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execu Use after free in Storage in Google Chrome prior to 141.0.7390.65 allowed a remote attacker to execute arbitrary code via a crafted video file. (Chromium security severity: High)

CVE-2025-11205 [HIGH] CWE-122 CVE-2025-11205: Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who Heap buffer overflow in WebGPU in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11209 [HIGH] CWE-290 CVE-2025-11209: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11211 [HIGH] CWE-125 CVE-2025-11211: Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to pot Out of bounds read in Media in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-12036 [HIGH] CWE-125 CVE-2025-12036: Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker Out of bounds memory access in V8 in Google Chrome prior to 141.0.7390.122 allowed a remote attacker to perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11206 [HIGH] CWE-122 CVE-2025-11206: Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to p Heap buffer overflow in Video in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11756 [HIGH] CWE-416 CVE-2025-11756: Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker w Use after free in Safe Browsing in Google Chrome prior to 141.0.7390.107 allowed a remote attacker who had compromised the renderer process to potentially perform out of bounds memory access via a crafted HTML page. (Chromium security severity: High)

CVE-2025-11213 [MEDIUM] CWE-451 CVE-2025-11213: Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a Inappropriate implementation in Omnibox in Google Chrome on Android prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11207 [MEDIUM] CWE-1300 CVE-2025-11207: Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote Side-channel information leakage in Storage in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform arbitrary read/write via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11215 [MEDIUM] CWE-193 CVE-2025-11215: Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform Off by one error in V8 in Google Chrome prior to 141.0.7390.54 allowed a remote attacker to perform an out of bounds memory read via a crafted HTML page. (Chromium security severity: Medium)

CVE-2025-11210 [MEDIUM] CWE-1300 CVE-2025-11210: Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote att Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)