CVE-2025-12910: Google Chrome Passkeys Info Disclosure Flaw

CVE-2025-12910 Overview

CVE-2025-12910 is an information disclosure vulnerability in the Passkeys component of Google Chrome versions prior to 140.0.7339.80. An inappropriate implementation causes potentially sensitive passkey-related information to be written to debug logs. A local attacker with access to those logs can read the exposed data without any user interaction. Chromium assigned this issue a security severity of Low, while the National Vulnerability Database (NVD) scores it as Medium. The flaw is tracked under CWE-1295: Debug Messages Revealing Unnecessary Information.

Critical Impact
A local attacker can harvest sensitive passkey information from Chrome debug logs on affected systems, potentially aiding credential-targeted follow-on attacks.

Affected Products

Google Chrome versions prior to 140.0.7339.80 (Desktop, Stable channel)
Chromium-based builds incorporating the vulnerable Passkeys implementation
All operating systems where Chrome Desktop is distributed (Windows, macOS, Linux)

Discovery Timeline

2025-11-08 - CVE-2025-12910 published to NVD
2026-10-07 - Last updated in NVD database

Technical Details for CVE-2025-12910

Vulnerability Analysis

The vulnerability resides in Chrome's Passkeys subsystem, which implements the WebAuthn credential flow for passwordless authentication. The implementation writes sensitive information related to passkey operations into debug log output. These logs are accessible to local processes and users with read access to the log location.

An attacker who already has local access to the host can inspect the debug logs and extract passkey-related data. The flaw does not permit remote exploitation, code execution, or modification of integrity. Impact is scoped to confidentiality of information handled by the Passkeys component.

Google addressed the issue as part of the Stable channel update that shipped Chrome 140.0.7339.80. See the Google Chrome Stable Update advisory for release details.

Root Cause

The root cause is categorized under CWE-1295, Debug Messages Revealing Unnecessary Information. The Passkeys code path emits log entries containing data that should not be exposed outside the authenticator boundary. Verbose or diagnostic logging intended for development was reachable in release builds.

Attack Vector

Exploitation requires local access to the system running the vulnerable Chrome build. An attacker reads the browser's debug log files or captures log output while Passkey operations occur. No privileges or user interaction are required beyond the ability to read the targeted log artifacts. See the Chromium Issue Tracker Entry for additional context.

No public proof-of-concept exploit or exploitation-in-the-wild report has been published for this CVE.

Detection Methods for CVE-2025-12910

Indicators of Compromise

Chrome debug log files on endpoints containing Passkey-related diagnostic entries
Unexpected processes reading from Chrome user data directories or log paths
Local user accounts enumerating files under Chrome profile directories without a business reason

Detection Strategies

Inventory Chrome installations and flag any build earlier than 140.0.7339.80 as vulnerable
Monitor file access events targeting Chrome log paths and user data directories on managed endpoints
Correlate local logons with subsequent access to browser profile or log artifacts, especially on shared or multi-user systems

Monitoring Recommendations

Enable endpoint telemetry for file read events on Chrome log and profile directories
Alert on command-line usage of Chrome debug flags such as --enable-logging and --v= on production endpoints
Track browser version compliance through configuration management to surface unpatched installs

How to Mitigate CVE-2025-12910

Immediate Actions Required

Update Google Chrome to version 140.0.7339.80 or later on all managed endpoints
Audit endpoints for lingering Chrome debug logs and purge files that may contain Passkey data
Restrict local access on multi-user systems where Chrome stores profile and log data

Patch Information

Google fixed CVE-2025-12910 in Chrome Stable 140.0.7339.80 for Desktop. Deploy the update through enterprise management tooling (Google Admin console, Chrome Browser Cloud Management, or OS package channels). Refer to the Google Chrome Stable Update advisory and the Chromium Issue Tracker Entry for build-specific guidance.

Workarounds

Disable Chrome verbose logging by removing --enable-logging and --v= flags from browser launch configurations
Enforce file system permissions that limit local user access to Chrome profile and log directories
Rotate and invalidate passkeys suspected of exposure through debug logs on previously vulnerable hosts

bash

# Verify installed Chrome version on Linux/macOS
google-chrome --version

# Windows: check version via registry
reg query "HKLM\Software\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Remove existing Chrome debug log (Linux example)
rm -f ~/.config/google-chrome/chrome_debug.log