CVE-2025-12436: Google Chrome Auth Bypass Vulnerability

CVE-2025-12436 Overview

CVE-2025-12436 is a policy bypass vulnerability in the Extensions component of Google Chrome prior to version 142.0.7444.59. An attacker who convinces a user to install a malicious extension can read potentially sensitive information from process memory through a crafted Chrome Extension. The flaw is classified under [CWE-306] (Missing Authentication for Critical Function) and affects Chrome on Windows, macOS, and Linux. Google rated the Chromium security severity as Medium and shipped a fix in the October 28, 2025 Stable Channel update for desktop.

Critical Impact
Successful exploitation exposes sensitive data residing in the browser process memory, which may include tokens, credentials, or content from other sites loaded within the browser.

Affected Products

Google Chrome prior to 142.0.7444.59 on Microsoft Windows
Google Chrome prior to 142.0.7444.59 on Apple macOS
Google Chrome prior to 142.0.7444.59 on Linux

Discovery Timeline

2025-11-10 - CVE-2025-12436 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12436

Vulnerability Analysis

The vulnerability resides in the Chrome Extensions subsystem, where policy enforcement around extension capabilities can be bypassed. A crafted extension can reach data in Chrome process memory that the extension policy is designed to prevent it from touching. The Common Weakness Enumeration classification [CWE-306] indicates a missing authentication or authorization check for a function that should be gated. Google Chrome executes extensions with restricted privileges relative to the renderer and browser processes, and the sandbox and policy layer normally block cross-boundary memory access. This flaw undermines those controls for a specific class of extension operations.

The attack requires user interaction to install the malicious extension. Once installed, the extension operates within the user's browser context and can query memory regions that hold sensitive artifacts. These artifacts may include authentication tokens, cookies, cached form data, or DOM contents from other tabs. Exploitation is described as requiring high attack complexity, so consistent extraction of useful data is not trivial.

Root Cause

The root cause is missing enforcement of the extension policy at a code path that touches process memory. Because the check that should authorize the access is absent, a crafted extension can invoke the code path and read memory it should not reach. Google's fix in Chrome 142.0.7444.59 closes the bypass by restoring the required authorization gate.

Attack Vector

The attack vector is network-adjacent through social engineering. An attacker publishes or distributes a malicious extension and convinces a user to install it, typically via the Chrome Web Store, sideloading, or an enterprise policy push. After installation, the extension executes its payload to read memory and exfiltrate the results to an attacker-controlled endpoint. No verified public proof-of-concept exists at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Technical specifics are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2025-12436

Indicators of Compromise

Newly installed Chrome extensions with broad permissions such as <all_urls>, debugger, nativeMessaging, or management
Outbound HTTPS connections from chrome.exe to low-reputation domains shortly after extension installation
Unexpected entries in the Chrome preferences file under extensions.settings for unmanaged users
Chrome versions below 142.0.7444.59 observed in endpoint inventory

Detection Strategies

Inventory installed Chrome extensions per host and compare against an approved allowlist
Alert on modifications to Chrome Preferences and Secure Preferences files outside of update windows
Correlate extension installation events with subsequent unusual network egress from the browser process
Track Chrome browser version telemetry to identify hosts running versions earlier than 142.0.7444.59

Monitoring Recommendations

Enable Chrome Enterprise reporting to forward extension install, update, and permission-grant events to your SIEM
Monitor process memory access patterns and unusual child processes spawned by chrome.exe
Baseline outbound traffic volume from browser processes and alert on statistical deviations

How to Mitigate CVE-2025-12436

Immediate Actions Required

Update Google Chrome to version 142.0.7444.59 or later on Windows, macOS, and Linux endpoints
Audit all installed Chrome extensions and remove any that are unapproved or exhibit excessive permissions
Enforce an extension allowlist through Chrome Enterprise policy to prevent installation of arbitrary extensions
Restart the Chrome browser on all managed endpoints to ensure the patched binary is active

Patch Information

Google released the fix in the Chrome Stable Channel update on October 28, 2025. Refer to the Google Chrome Stable Update advisory for release notes and full CVE list. Enterprises using Chrome Browser Cloud Management should verify that update rollouts have reached all managed devices.

Workarounds

Configure the ExtensionInstallBlocklist policy to * and use ExtensionInstallAllowlist to restrict installations to vetted extensions
Set ExtensionInstallForcelist for required business extensions and remove unmanaged installs
Disable developer mode on managed browsers to block sideloaded unpacked extensions
Educate users to avoid installing extensions from outside the Chrome Web Store and to review requested permissions

bash

# Chrome Enterprise policy example (Linux JSON policy file: /etc/opt/chrome/policies/managed/extensions.json)
{
  "ExtensionInstallBlocklist": ["*"],
  "ExtensionInstallAllowlist": [
    "aapocclcgogkmnckokdopfmhonfmgoek",
    "ghbmnnjooekpmoecnnnilnnbdlolhkhi"
  ],
  "ExtensionSettings": {
    "*": {
      "installation_mode": "blocked",
      "runtime_blocked_hosts": ["*://*/*"]
    }
  }
}