CVE-2025-12440: Google Chrome Information Disclosure Flaw

CVE-2025-12440 Overview

CVE-2025-12440 is an information disclosure vulnerability in the Autofill component of Google Chrome versions prior to 142.0.7444.59. A remote attacker who convinces a user to perform specific user interface gestures can read potentially sensitive information from process memory through a crafted HTML page. The flaw is tracked under [CWE-120] (buffer copy without checking size of input) and affects Chrome on Windows, macOS, and Linux. Google classified the Chromium security severity as Low, while the NVD assigned a medium CVSS rating based on high confidentiality impact requiring user interaction.

Critical Impact
Remote attackers can extract sensitive data from Chrome renderer process memory when users interact with a malicious page, potentially exposing form data, credentials, or other in-memory artifacts.

Affected Products

Google Chrome prior to 142.0.7444.59
Chrome on Microsoft Windows
Chrome on Apple macOS and Linux distributions

Discovery Timeline

2025-11-10 - CVE-2025-12440 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12440

Vulnerability Analysis

The vulnerability resides in Chrome's Autofill subsystem, which handles automatic completion of form fields such as addresses, payment information, and saved credentials. An inappropriate implementation in this component allows a crafted HTML page to trigger conditions where memory contents outside the intended data boundary become observable to the attacker. The classification under [CWE-120] indicates the root defect involves copying data without properly validating input size, resulting in adjacent memory being exposed. Exploitation requires the victim to perform specific UI gestures, which raises attack complexity because the attacker must lure a user into predictable interaction patterns with the malicious page.

Root Cause

The defect stems from improper bounds handling in Autofill logic when processing attacker-influenced HTML input. Because size checks are insufficient before a copy operation, the routine reads or exposes memory beyond the intended source buffer. Sensitive content residing in the renderer process — including form values, cached strings, or heap fragments — can then be leaked back to the attacker-controlled page.

Attack Vector

Exploitation is network-based and requires no authentication. The attacker hosts a crafted HTML page and induces the victim to visit it and perform specific UI gestures such as clicking an autofill suggestion or interacting with a specially constructed form. Successful exploitation discloses process memory content but does not modify data or affect availability. No public exploit or CISA KEV listing is associated with this CVE, and the EPSS probability remains low, consistent with the interaction requirement.

No verified proof-of-concept code has been published. Technical details are tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2025-12440

Indicators of Compromise

Chrome browser versions below 142.0.7444.59 reported by endpoint inventory or user-agent telemetry.
Outbound connections from Chrome renderer processes to unfamiliar domains hosting form-heavy or autofill-triggering pages.
Browser crash reports or renderer anomalies coinciding with visits to unknown HTML pages containing unusual autofill markup.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build earlier than 142.0.7444.59.
Monitor DNS and proxy logs for user navigation to newly registered or low-reputation domains that host input forms.
Correlate browser process telemetry with HTTP POST payloads that echo unexpected binary or high-entropy strings, which may indicate leaked memory being exfiltrated.

Monitoring Recommendations

Enable enterprise Chrome update reporting through Chrome Browser Cloud Management or Group Policy to track version compliance.
Ingest browser and endpoint telemetry into a centralized SIEM to build alerts on outdated Chrome versions communicating with untrusted hosts.
Review autofill-related settings and audit logs where password manager or payment autofill integrations are in use.

How to Mitigate CVE-2025-12440

Immediate Actions Required

Update Google Chrome to version 142.0.7444.59 or later on all Windows, macOS, and Linux endpoints.
Restart Chrome after the update to ensure the patched binary is loaded into memory.
Verify that automatic updates are enabled and functioning for both user-installed and enterprise-managed Chrome deployments.

Patch Information

Google released the fix in the Chrome Stable channel update announced on the Google Chrome Desktop Update blog. Enterprise administrators should push version 142.0.7444.59 or later through their software distribution mechanism. Chromium-based browsers that consume upstream fixes should apply the equivalent patched release.

Workarounds

Disable Chrome Autofill for addresses, payment methods, and passwords via Chrome settings or enterprise policy until the patched build is deployed.
Enforce user awareness guidance to avoid interacting with autofill prompts on untrusted or unfamiliar websites.
Restrict browsing to reputable sites through web filtering or DNS filtering while the update is being rolled out.

bash

# Verify installed Chrome version on Linux
google-chrome --version

# Windows: Query Chrome version from registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Enterprise policy to disable Autofill (managed JSON)
# Place in Chrome managed policies
# {
#   "AutofillAddressEnabled": false,
#   "AutofillCreditCardEnabled": false,
#   "PasswordManagerEnabled": false
# }