CVE-2025-12445: Google Chrome Auth Bypass Vulnerability

CVE-2025-12445 Overview

CVE-2025-12445 is a policy bypass vulnerability in the Extensions component of Google Chrome prior to version 142.0.7444.59. An attacker who convinces a user to install a malicious Chrome Extension can leak cross-origin data through a crafted extension. The flaw is classified under [CWE-288: Authentication Bypass Using an Alternate Path or Channel]. Chromium security team rated the underlying issue as Low severity, though the NVD assigned a higher score reflecting network reachability and lack of privileges required. Affected desktop platforms include Windows, macOS, and Linux builds of Chrome.

Critical Impact
A malicious extension can bypass browser policy controls to read cross-origin data, exposing information from sites the user visits.

Affected Products

Google Chrome prior to 142.0.7444.59
Microsoft Windows desktop installations of Chrome
Apple macOS and Linux desktop installations of Chrome

Discovery Timeline

2025-11-10 - CVE-2025-12445 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12445

Vulnerability Analysis

The vulnerability resides in the Chrome Extensions subsystem, which enforces policies governing how extensions interact with web origins. Chrome's extension model relies on manifest-declared permissions and host access policies to isolate extension code from cross-origin data. This flaw allows an attacker-controlled extension to bypass those policy checks and access data belonging to other origins. The result is a cross-origin data leak that undermines the browser's same-origin policy for users who install the crafted extension.

Root Cause

The root cause is an authentication bypass using an alternate path, tracked as [CWE-288]. Chrome's extension policy layer fails to consistently validate a code path that extensions can invoke, allowing the extension to reach cross-origin resources without the enforcement checks the policy is designed to apply. The specific implementation details are tracked in Chromium Issue #428397712, which remains restricted at the time of publication.

Attack Vector

Exploitation requires the attacker to convince a user to install a malicious extension, typically through social engineering, a sideloaded package, or a compromised extension listing. Once installed, the extension leverages the policy bypass to issue requests or access data across origins that Chrome would normally block. No additional user interaction is required after installation, and the attack occurs entirely within the browser process on the victim's endpoint. No public proof-of-concept exploit exists at the time of writing, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

// No verified public exploit code is available for CVE-2025-12445.
// Refer to Chromium Issue #428397712 for technical tracking details
// once the issue is unrestricted.

Detection Methods for CVE-2025-12445

Indicators of Compromise

Unexpected Chrome extensions installed on managed endpoints, especially those loaded from developer mode or outside the Chrome Web Store.
Outbound network requests from chrome.exe to unfamiliar domains that correlate with recently installed extensions.
Extension manifests requesting broad host_permissions such as <all_urls> that were not previously present in the fleet.

Detection Strategies

Inventory installed Chrome extensions across endpoints and compare extension IDs against an approved allowlist.
Monitor the Extensions directory within Chrome user profiles for newly created subfolders and modified manifest files.
Alert on Chrome versions reporting below 142.0.7444.59 in endpoint telemetry and asset inventory data.

Monitoring Recommendations

Ingest browser and endpoint telemetry into a centralized data lake to correlate extension installations with subsequent cross-origin network activity.
Track Chrome update compliance across Windows, macOS, and Linux fleets and flag hosts that lag behind the current stable channel.
Review enterprise policy logs for changes to ExtensionInstallAllowlist, ExtensionInstallBlocklist, and ExtensionInstallForcelist.

How to Mitigate CVE-2025-12445

Immediate Actions Required

Update Google Chrome to version 142.0.7444.59 or later on all Windows, macOS, and Linux endpoints.
Audit installed extensions and remove any that are unapproved, unsigned, or sideloaded from developer mode.
Enforce an extension allowlist through enterprise policy to prevent users from installing arbitrary extensions.

Patch Information

Google addressed CVE-2025-12445 in the Chrome Stable channel release documented in the Google Chrome Stable Channel Update for Desktop. The fix is included in Chrome 142.0.7444.59 and later. Deploy the update through the vendor's managed update channel or enterprise deployment tooling as soon as validation testing completes.

Workarounds

Configure the ExtensionInstallBlocklist policy with a wildcard value to block all extensions, then selectively allowlist required ones until patching is complete.
Restrict extension installations to the Chrome Web Store using the ExtensionInstallSources policy to reduce the risk of sideloaded malicious packages.
Educate users to avoid installing extensions from untrusted sources and to report unexpected extension prompts.

bash

# Example Windows Group Policy registry configuration to block
# all extensions except explicitly allowlisted IDs
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallBlocklist" /v 1 /t REG_SZ /d "*" /f
reg add "HKLM\Software\Policies\Google\Chrome\ExtensionInstallAllowlist" /v 1 /t REG_SZ /d "<approved-extension-id>" /f