Skip to content
OpenAdvisories
Medium · 5.4 CVE-2025-12905 EUVD-2025-38340GHSA-2327-x98x-57c5

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of th…

Published Nov 7, 2025 · Updated Nov 10, 2025 · Assigned by Chrome

Vendor: Google Product: Chrome Package: chromium Category: Browsers Ecosystem: Wolfi

Description

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)

Affected products

VendorProductAffectedFixed
Google Chrome 140.0.7339.80 – < 140.0.7339.80 140.0.7339.80

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Wolfi

ReleasePackageFixed inAdvisory
Wolfi rolling chromium 140.0.7339.80-r0 —

Advisories 1

References