CVE-2025-1921: Google Chrome Information Disclosure Bug

CVE-2025-1921 Overview

CVE-2025-1921 is an information disclosure vulnerability in the Media Stream component of Google Chrome versions prior to 134.0.6998.35. A remote attacker can exploit the flaw by convincing a user to visit a crafted HTML page. Successful exploitation allows the attacker to obtain information about a peripheral device connected to the victim's system. Google's Chromium team classified the security severity as Medium. The weakness is tracked under CWE-1230: Exposure of Sensitive Information Through Metadata.

Critical Impact
Remote attackers can enumerate information about peripheral devices attached to a victim's browser session by luring the user to a malicious web page.

Affected Products

Google Chrome versions prior to 134.0.6998.35
Chromium-based browsers incorporating vulnerable Media Stream code
Desktop Chrome channels (Windows, macOS, Linux) on the Stable channel prior to the March 2025 update

Discovery Timeline

2025-03-05 - CVE-2025-1921 published to NVD following the Chrome Stable channel update
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1921

Vulnerability Analysis

The vulnerability resides in Chrome's Media Stream implementation, the browser subsystem that mediates access to audio and video capture devices through the WebRTC and getUserMedia APIs. An inappropriate implementation permits a remote origin to derive information about a peripheral device without the level of user consent normally required. The flaw maps to CWE-1230, which covers exposure of sensitive information through metadata. The attacker gains reconnaissance data useful for fingerprinting, targeting follow-on exploits, or profiling the victim's hardware environment. Confidentiality is impacted, while integrity and availability are unaffected.

Root Cause

The defect stems from insufficient enforcement of privacy boundaries in the Media Stream code path. Chrome exposed peripheral-related metadata to web content in a manner that should have been gated by explicit user permission or origin restrictions. Because the exposure occurs before or outside of the normal permission prompt flow, an attacker-controlled page can query the API and infer device attributes that should remain private.

Attack Vector

Exploitation is network-based and requires user interaction. An attacker hosts a crafted HTML page and directs the victim to open it, typically through phishing, malvertising, or a compromised website. When the page loads, embedded JavaScript invokes the vulnerable Media Stream interfaces to enumerate peripheral information. No authentication is required, and no privileged position on the network is needed. Public technical detail is limited because the Chromium Issue #387583503 tracker restricts access to the underlying bug report. Additional context is available in the Google Chrome Stable Update release notes.

Detection Methods for CVE-2025-1921

Indicators of Compromise

Outbound HTTPS requests from browser processes to unfamiliar domains immediately followed by anomalous Media Stream or navigator.mediaDevices API activity in browser telemetry.
Chrome processes running versions earlier than 134.0.6998.35 after the March 2025 patch window.
User reports of unexpected media permission prompts or peripheral enumeration from untrusted sites.

Detection Strategies

Inventory installed Chrome versions across managed endpoints and flag any build older than 134.0.6998.35 as vulnerable.
Correlate web proxy logs with browser telemetry to identify visits to newly registered or low-reputation domains that load scripts referencing getUserMedia or enumerateDevices.
Deploy browser extension policies or endpoint content inspection to log Media Stream API calls in high-risk user populations.

Monitoring Recommendations

Track Chrome auto-update compliance through enterprise management tooling and alert on stalled installations.
Monitor DNS and HTTP telemetry for indicators of malvertising or drive-by download infrastructure delivering crafted HTML payloads.
Alert on browser child processes spawning unexpected media capture or device access routines shortly after navigation events.

How to Mitigate CVE-2025-1921

Immediate Actions Required

Update Google Chrome to version 134.0.6998.35 or later on all Windows, macOS, and Linux endpoints.
Restart the browser after patch installation to ensure the fix is loaded into all Chrome processes.
Audit any Chromium-based browsers (Edge, Brave, Opera, Vivaldi) and apply vendor updates that incorporate the upstream Chromium fix.

Patch Information

Google released the fix in the Chrome Stable channel update announced on March 4, 2025. The patched build is 134.0.6998.35 for desktop platforms. Refer to the Google Chrome Stable Update release notes for full version details and additional CVEs addressed in the same release.

Workarounds

Enforce enterprise policies that block camera and microphone access on untrusted origins until Chrome is updated.
Restrict browsing to trusted sites via web proxy or DNS filtering for users who cannot immediately update.
Disable media capture permissions globally through HardwareAcceleratedMediaDefault and related Chrome enterprise policies where operationally acceptable.

bash

# Verify Chrome version on Linux/macOS endpoints
google-chrome --version

# Windows PowerShell: query installed Chrome version
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion

# Chrome enterprise policy snippet to disable media capture on untrusted sites
# Place in the appropriate policy JSON or registry location for managed deployments
{
  "VideoCaptureAllowed": false,
  "AudioCaptureAllowed": false
}