CVE-2025-12909CWE-693

CVE-2025-12909

Medium · published November 8, 2025

CVSS v3.1

5.3

EPSS

Percentile

9.8

In the wild

Unconfirmed

What it is

Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)

The record

Technical detail

CVSS v3.1: 5.3 · MEDIUM
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0: Not supplied
EPSS: 0.00203 · 9.8th percentile
Weakness: CWE-693 · Protection Mechanism Failure
Published: 2025-11-08T05:15Z

Affected products (1)

Product	Versions	Fixed in
google/chrome	< 140.0.7339.80	140.0.7339.80

References (2)

https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html · [email protected]https://issues.chromium.org/issues/361116749 · [email protected]

EPSS history

Timeline

07 NOV 23:23Z
Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools
cvelistv5