PT-2025-9736 · Google+3 · Google Chrome+3

Topi Lassila · Publicado 2025-03-04 · Atualizado 2025-04-03 · CVE-2025-1915

Positive Technologies (AI Summary)

CVSS v2.0

9.4

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 134.0.6998.35

Description The issue is related to improper limitation of a pathname to a restricted directory in DevTools. An attacker could bypass file access restrictions by convincing a user to install a malicious extension, which could then utilize a crafted Chrome Extension to exploit this issue.

Recommendations For versions prior to 134.0.6998.35, update to version 134.0.6998.35 or later to resolve the issue.

Exploit

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

ALT-PU-2025-4164

ALT-PU-2025-4366

BDU:2025-02670

CVE-2025-1915

DSA-5875-1

MGASA-2025-0091

OPENSUSE-SU-2025:0084-1

OPENSUSE-SU-2025:14854-1

Produtos afetados

Alt Linux

Debian

Google Chrome

Red Os

Referências · 65

• 🔥 https://github.com/ading2210/CVE-2024-6778-POC · Exploit
• 🔥 https://github.com/bi-zone/CVE-2024-7965 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-7965-poc · Exploit
• 🔥 https://github.com/r00tjunip3r1/POC-CVE-2024-6778 · Exploit
• https://twitter.com/windowsforum/status/1899358544207499730 · Publicação no Twitter
• https://issues.chromium.org/issues/391114799 · Nota
• https://twitter.com/windowsforum/status/1899311860781908146 · Publicação no Twitter
• https://twitter.com/cracbot/status/1899052693190304089 · Publicação no Twitter
• https://osv.dev/vulnerability/DSA-5875-1 · Aviso do Fabricante
• https://security.paloaltonetworks.com/PAN-SA-2025-0007 · Nota
• https://suse.com/security/cve/CVE-2025-1922 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2025-1915 · Nota de Segurança
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1 · Nota
• https://suse.com/security/cve/CVE-2025-1919 · Nota
• https://osv.dev/vulnerability/CVE-2025-1915 · Aviso do Fabricante