Product:
Chrome
Summary
Inappropriate implementation in Mojo in Google Chrome on Android, Linux, and ChromeOS prior to 140.0.7339.127 allowed a remote attacker to bypass site isolation via a crafted HTML page. This vulnerability has been classified with a high severity level due to its potential impact on confidentiality, integrity, and availability.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-10201 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious HTML page that, when visited by a user, can bypass site isolation protections. This requires the user to interact with the page, making user interaction a necessary component of the attack. Once the user opens the crafted page, the attacker can potentially access sensitive information or perform unauthorized actions within the browser.
Affected Products
- Google Chrome on Android: Vulnerable versions prior to 140.0.7339.127 allow site isolation bypass.
- Google Chrome on Linux: Vulnerable versions prior to 140.0.7339.127 allow site isolation bypass.
- Google Chrome on ChromeOS: Vulnerable versions prior to 140.0.7339.127 allow site isolation bypass.
Mitigation
Users are advised to update their Google Chrome browser to version 140.0.7339.127 or later to mitigate this vulnerability. Regularly updating software can help protect against known vulnerabilities and enhance overall security.