CVE-2025-12906CWE-693

CVE-2025-12906

Medium · published November 8, 2025

CVSS v3.1

5.4

EPSS

Percentile

6.1

In the wild

Unconfirmed

What it is

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

The record

Technical detail

CVSS v3.1: 5.4 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:L
CVSS v4.0: Not supplied
EPSS: 0.00170 · 6.1th percentile
Weakness: CWE-693 · Protection Mechanism Failure
Published: 2025-11-08T05:15Z

Affected products (1)

Product	Versions	Fixed in
google/chrome	< 140.0.7339.80	140.0.7339.80

References (2)

https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html · [email protected]https://issues.chromium.org/issues/428455319 · [email protected]

EPSS history

Timeline

07 NOV 23:23Z
Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page
cvelistv5