CVE-2025-12911: Google Chrome XSS Vulnerability

CVE-2025-12911 Overview

CVE-2025-12911 is a user interface (UI) spoofing vulnerability in the Permissions component of Google Chrome versions prior to 140.0.7339.80. A remote attacker can serve a crafted HTML page that manipulates the appearance of permission prompts, misleading users into granting access to sensitive browser capabilities. The flaw is classified under [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. Exploitation requires user interaction with the malicious page. Google resolved the issue in the September 2025 stable channel update for desktop.

Critical Impact
Remote attackers can spoof Chrome permission dialogs through a crafted web page, tricking users into approving actions or disclosures they did not intend.

Affected Products

Google Chrome for Desktop versions prior to 140.0.7339.80
Chromium-based builds incorporating the pre-patch Permissions implementation
Downstream browsers that had not yet merged the Chromium 140 fix at the time of release

Discovery Timeline

2025-11-08 - CVE-2025-12911 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD

Technical Details for CVE-2025-12911

Vulnerability Analysis

The vulnerability resides in the Permissions subsystem of Google Chrome. Chrome uses this subsystem to prompt users before granting access to capabilities such as geolocation, camera, microphone, notifications, and clipboard reads. An inappropriate implementation allowed a remote attacker to influence how these prompts are presented to users. By serving a specifically crafted HTML page, the attacker can render UI elements that obscure or misrepresent the true intent of the permission request. Chromium's security team assigned an internal severity of Low, and the issue is limited to integrity of information displayed to the user rather than direct code execution. Exploitation depends on the target visiting an attacker-controlled page and interacting with the spoofed prompt.

Root Cause

The root cause is an implementation defect in how Chrome renders and sequences permission-related UI. The browser did not sufficiently isolate the trusted permission chrome from content-controlled elements on the page. This mismatch enables an attacker to influence the perceived context of a permission request, which is the exact scenario described by [CWE-451].

Attack Vector

The attack vector is network-based and requires user interaction. A victim must load a crafted HTML page in a vulnerable Chrome build. Once loaded, the page uses layout, timing, or DOM techniques to overlap or reframe the permission prompt. If the victim clicks Allow, the origin receives a permission grant it would not have obtained through a truthful prompt. There is no impact on confidentiality or availability, and integrity impact is limited to the permission decision itself.

No verified public exploit code is available. Technical discussion is tracked in the Chromium Issue Tracker Entry.

Detection Methods for CVE-2025-12911

Indicators of Compromise

Chrome browser processes reporting a version string earlier than 140.0.7339.80 in endpoint inventory
User reports of unexpected permission grants for geolocation, camera, microphone, or notifications following visits to unfamiliar sites
Outbound connections to newly registered or low-reputation domains immediately preceding permission-driven telemetry such as geolocation lookups

Detection Strategies

Query endpoint inventory for installed Chrome versions and flag any build below 140.0.7339.80
Correlate web proxy logs with Chrome permission activity to identify pages that prompt for sensitive permissions on first visit
Review browser telemetry or enterprise policy logs for anomalous grants of geolocation, media capture, or notification permissions

Monitoring Recommendations

Track Chrome auto-update health across managed endpoints to confirm patched versions are being deployed
Monitor DNS and HTTP logs for user visits to suspicious domains hosting HTML content that requests high-value permissions
Alert on repeated user-reported UI anomalies in Chrome, which can indicate spoofing attempts

How to Mitigate CVE-2025-12911

Immediate Actions Required

Update Google Chrome to version 140.0.7339.80 or later on all Windows, macOS, and Linux endpoints
Verify that Chrome auto-update is enabled and not blocked by group policy or network filtering
Restart Chrome after the update so the new binaries are loaded into all user sessions

Patch Information

Google released the fix in the Chrome stable channel update announced in September 2025. See the Google Chrome Update Announcement for release notes and the Chromium Issue Tracker Entry for the underlying bug reference. Users on 140.0.7339.80 or later are not affected.

Workarounds

Use enterprise policies to deny sensitive permissions such as geolocation, camera, and microphone by default until browsers are patched
Restrict browsing to trusted sites through URL filtering while patch rollout is in progress
Educate users to reject permission prompts on unfamiliar sites and to report unexpected prompt behavior to the security team

bash

# Example: enforce default-deny for sensitive Chrome permissions via enterprise policy (Linux managed policy)
cat >/etc/opt/chrome/policies/managed/permissions.json <<'EOF'
{
  "DefaultGeolocationSetting": 2,
  "DefaultNotificationsSetting": 2,
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false
}
EOF