CVE-2025-12905: Google Chrome Auth Bypass Vulnerability

CVE-2025-12905 Overview

CVE-2025-12905 is an inappropriate implementation vulnerability in the Downloads component of Google Chrome on Windows. Versions prior to 140.0.7339.80 fail to correctly apply the Mark of the Web (MotW) attribute to certain downloaded files. A remote attacker can bypass MotW protections by serving a crafted HTML page to a victim who interacts with the download.

The issue is tracked under CWE-346: Origin Validation Error and affects Chrome on Windows systems where MotW governs whether Windows applies additional execution warnings and Protected View restrictions. Chromium rates the security severity as Low.

Critical Impact
A successful bypass strips the MotW tag from files delivered via Chrome, allowing malicious documents and executables to execute on Windows without the standard SmartScreen or Office Protected View warnings.

Affected Products

Google Chrome on Windows prior to 140.0.7339.80
Microsoft Windows hosts where MotW is the enforcement mechanism for downloaded content
Downstream Chromium-based browsers that inherit the same Downloads implementation until they merge the upstream fix

Discovery Timeline

2025-11-08 - CVE-2025-12905 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12905

Vulnerability Analysis

Google Chrome writes an alternate data stream named Zone.Identifier to files downloaded from the internet on Windows. This stream carries the MotW tag, which signals to Windows Defender SmartScreen, Microsoft Office, and shell execution policies that the file originated from an untrusted zone. Chrome versions prior to 140.0.7339.80 fail to attach this identifier under attacker-controlled conditions triggered from a crafted HTML page.

An attacker who convinces a user to visit a malicious page can deliver a file without the trust boundary marker. Office documents open without Protected View, .hta and script files run without SmartScreen prompts, and installer binaries skip publisher validation warnings. The bypass amplifies phishing and drive-by download campaigns that already rely on MotW evasion techniques.

Exploitation requires user interaction to initiate or accept the download, aligning with the UI:R element of the CVSS vector. No authentication or elevated privileges are needed on the target system.

Root Cause

The root cause is an origin validation failure [CWE-346] in the Downloads code path. Chrome does not consistently propagate the source zone metadata to the file writer, leaving the Zone.Identifier alternate data stream absent or incomplete for files produced through the crafted download flow.

Attack Vector

The attack vector is a web page hosting a specifically constructed HTML payload that triggers the vulnerable download logic. The victim must load the page in a vulnerable Chrome build and complete the download interaction. Once written to disk without MotW, the file bypasses subsequent Windows trust checks when opened by the user or a secondary process. No verified public proof-of-concept is available at the time of writing. Refer to the Chromium Issue Tracker entry and the Chrome Desktop Update Announcement for vendor-provided detail.

Detection Methods for CVE-2025-12905

Indicators of Compromise

Files created by chrome.exe in user Downloads directories that lack a Zone.Identifier alternate data stream despite originating from an HTTP or HTTPS source.
Office documents, .hta, .js, .vbs, or .lnk files executing from %USERPROFILE%\Downloads without SmartScreen or Protected View prompts.
Browser telemetry showing downloads followed by immediate child process execution of scripting hosts such as wscript.exe, mshta.exe, or powershell.exe.

Detection Strategies

Audit downloaded files for the presence of the Zone.Identifier NTFS alternate data stream and flag files sourced from browsers that are missing it.
Correlate Chrome download events with subsequent process execution to surface documents or scripts running without expected MotW warnings.
Track installed Chrome versions across the fleet and alert on hosts running builds earlier than 140.0.7339.80.

Monitoring Recommendations

Ingest Sysmon Event ID 15 (FileCreateStreamHash) to record Zone.Identifier writes and detect their absence for browser-originated files.
Monitor EDR file-write telemetry for chrome.exe producing executable or script content in user-writable directories.
Alert on child processes spawned from Office applications after opening files downloaded by Chrome.

How to Mitigate CVE-2025-12905

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 140.0.7339.80 or later.
Verify enterprise browser policies enforce automatic updates and restart Chrome to apply the patched binary.
Review recent downloads for high-risk file types opened without MotW warnings and investigate the originating pages.

Patch Information

Google released the fix in the Stable channel update documented in the Chrome Desktop Update Announcement. Administrators should confirm the deployed build reports 140.0.7339.80 or higher via chrome://settings/help. Chromium-based browsers should be updated to a release that merges the upstream Downloads fix.

Workarounds

Block execution of downloaded script and installer file types from user Downloads directories using Windows Defender Application Control or AppLocker rules.
Enforce SmartScreen for Microsoft Edge and Windows shell to add a secondary reputation check independent of the browser MotW tag.
Restrict Chrome extensions and enterprise download policies to trusted domains until patching is complete.

bash

# Verify Chrome version on Windows endpoints via PowerShell
(Get-Item "$env:ProgramFiles\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# List files in Downloads missing the Zone.Identifier alternate data stream
Get-ChildItem "$env:USERPROFILE\Downloads" -File | Where-Object {
    -not (Get-Item $_.FullName -Stream Zone.Identifier -ErrorAction SilentlyContinue)
}