CVE-2025-12726CWE-269privilege-escalation

CVE-2025-12726

High · published November 11, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
13.9
In the wild
Unconfirmed
What it is

🚨 A crafty HTML page could be your browser's undoing! An attacker who compromises the renderer process in Google Chrome on Windows versions prior to 142.0.7444.137 can exploit this vulnerability to escalate their privileges. 🔥 Think of it like a hotel where a guest sneaks into the staff area, gaining access to keys and rooms they shouldn't have. This vulnerability is a sneaky way for an attacker to gain authority beyond their intended privileges. If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive parts of your system, potentially leading to data leaks or worse—a complete takeover of your browser's capabilities! Yikes!

Put simply

Think of it like a hotel where a guest sneaks into the staff area, gaining access to keys and rooms they shouldn't have. This vulnerability is a sneaky way for an attacker to gain authority beyond their intended privileges. This privilege escalation flaw arises from an inappropriate implementation in the Views module of Google Chrome, enabling a compromised renderer process to perform actions that should normally be restricted.

What to do

If exploited, this vulnerability could allow an attacker to gain unauthorized access to sensitive parts of your system, potentially leading to data leaks or worse—a complete takeover of your browser's capabilities! Yikes! To protect yourself, immediately update Google Chrome to version 142.0.7444.137 or later. Regularly check for browser updates and ensure your security settings are configured correctly for added protection. 🛡️ You've got this! Stay vigilant, keep that browser updated, and you'll maintain your hero status in the security world! 🚀

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00237 · 13.9th percentile
Weakness
CWE-269 · Improper Privilege Management
Published
2025-11-11T01:15Z
Affected products (1)
ProductVersionsFixed in
google/chrome< 142.0.7444.134142.0.7444.134
References (2)
EPSS history
Timeline
  • 10 NOV 20:00Z
    Inappropriate implementation in Views in Google Chrome on Windows prior to 142.0.7444.137 allowed a remote attacker who had compromised the renderer process to…
    cvelistv5