Product: Chrome
Summary
Inappropriate implementation in Extensions in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to bypass content security policy via a crafted HTML page. This vulnerability has a medium severity rating and can lead to significant security risks.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-9866 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious HTML page that bypasses the content security policy of the affected Chrome version. When a user interacts with this page, it can lead to unauthorized access or manipulation of sensitive data, as the security measures intended to protect the user are circumvented.
Affected Products
- Google Chrome: Versions prior to 140.0.7339.80 are affected by this vulnerability, allowing for potential security breaches through crafted HTML pages.
Mitigation
To mitigate this vulnerability, users should update their Google Chrome browser to the latest version. Regular updates ensure that security patches are applied, reducing the risk of exploitation from known vulnerabilities.