CVE-2025-8881: google chrome
CVSS: 6.5v3.1MediumAnalyzed
AliasesDEBIAN-CVE-2025-8881CGA-q5gf-p8rf-mgc9CGA-qwhw-p5g2-494m
Published 13-08-2025Last modified 13-08-2025
Vulnerability summary
CVE-2025-8881 is a medium (CVSS 6.5) vulnerability in google chrome. EPSS estimates a 0.25% chance of exploitation in the next 30 days, higher than 15% of scored vulnerabilities.
CVSS score
6.5/10
010
Medium · v3.1 (CVE.org)EPSS score
0.25%
0%100%
Low · +0.01 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2 · Related 2Timeline
- 13-08-2025PublishedVulnerability first disclosed.
- 13-08-2025Last modifiedVulnerability information updated.
Description
Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NSourcesAll 5 agree
- OSV · DebianEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- NVDNIST6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.5MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS trend
Probability
0.25%
Chance of exploitation in the next 30 days
Percentile
15%
Versus all other CVEs
30-day change
+0.01 pp
From 0.24% on 20-09-2026
20-09-202620-10-2026
EPSS score0.25%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-303Incorrect Implementation of Authentication AlgorithmThe requirements for the product dictate the use of an established authentication algorithm, but the implementation of the algorithm is incorrect.
- CWE-346Origin Validation ErrorThe product does not properly verify that the source of data or communication is valid.
Affected systems
Chainguard1 product
- chromium< 139.0.7258.127-r0
Debian1 product
- chromium< 139.0.7258.127-1~deb12u1 | < 139.0.7258.127-1~deb13u1 | < 139.0.7258.127-1
Google1 product
- chrome≥ 139.0.7258.127, < 139.0.7258.127 | < 139.0.7258.127
Wolfi1 product
- chromium< 139.0.7258.127-r0
4 vendors · 4 products
References
3 links- chromereleases.googleblog.com/2025/08/stable-channel-update-for-desktop_12.htmlAdvisoryRelease NotesVendor Advisory
