CVE-2025-12909 — Vulnetix

CVE-2025-12909 PUBLISHED CVSS 9.300000190734863 CRITICAL

Insufficient policy enforcement in Devtools in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to leak cross-origin data via Devtools. (Chromium security severity: Low)

EPSS 0.05% · 15.6th percentile

Risk Scores

CVSS 4.0

9.300000190734863

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

EPSS Score

0.05%

15.6th percentile

Affected Products

Vendor	Product	Versions
google	chrome	0
Google	Chrome	140.0.7339.80

Exploit Intelligence

https://issues.chromium.org/issues/361116749 (nist-nvd)
CIRCL seen: CVE-2025-12909 (circl-sighting)
https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html (circl)

Timeline

Nov 7, 2025 CVE Published
Nov 8, 2025 EPSS Score
Nov 8, 2025 Coalition ESS Score
Nov 8, 2025 PoC Published
Nov 9, 2025 Coalition ESS Score
Nov 10, 2025 Coalition ESS Score
Nov 12, 2025 Coalition ESS Score
Nov 13, 2025 EPSS Score
Nov 14, 2025 Coalition ESS Score
Nov 19, 2025 EPSS Score
Nov 21, 2025 CVE Updated
Nov 22, 2025 Coalition ESS Score

References

Open in Interactive Console →