Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: Google Chrome 140.0.7339.80 Clear all filters
TI-2025-11827 CVE-2025-12909 · GHSA-cvvh-gp7g-9334

Protection mechanism failure in Google Chrome

Priority LOW 29

Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00203 Published 2025-11-07 Fixed in 140.0.7339.80 CWE-693
TI-2025-11826 CVE-2025-12908 · GHSA-3jxx-m7vj-jgc2

Improper input validation in Google Chrome

Priority LOW 24

Insufficient validation of untrusted input in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform domain spoofing via a crafted HTML page.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0019 Published 2025-11-07 Fixed in 140.0.7339.80 CWE-20
TI-2025-11825 CVE-2025-12907 · GHSA-885p-rxgp-x27q

Improper input validation in Google Chrome

Priority HIGH 73

Insufficient validation of untrusted input in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to execute arbitrary code via user action in Devtools.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00294 Published 2025-11-07 Fixed in 140.0.7339.80 CWE-20
TI-2025-11824 CVE-2025-12906 · GHSA-4m4m-6fm5-244f

Protection mechanism failure in Google Chrome

Priority LOW 24

Inappropriate implementation in Permissions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.0017 Published 2025-11-07 Fixed in 140.0.7339.80 CWE-693
TI-2025-11823 CVE-2025-12905 · GHSA-2327-x98x-57c5

Origin validation error in Google Chrome

Priority LOW 24

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page.

CVSS 3.1MEDIUM 5.4 Network No auth User interaction EPSS 0.00165 Published 2025-11-07 Fixed in 140.0.7339.80 CWE-346