PT-2025-9736 · Google+3 · Google Chrome+3

Topi Lassila · Published 2025-03-04 · Updated 2025-04-03 · CVE-2025-1915

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 134.0.6998.35

Description The issue is related to improper limitation of a pathname to a restricted directory in DevTools. An attacker could bypass file access restrictions by convincing a user to install a malicious extension, which could then utilize a crafted Chrome Extension to exploit this issue.

Recommendations For versions prior to 134.0.6998.35, update to version 134.0.6998.35 or later to resolve the issue.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

ALT-PU-2025-4164

ALT-PU-2025-4366

BDU:2025-02670

CVE-2025-1915

DSA-5875-1

MGASA-2025-0091

OPENSUSE-SU-2025:0084-1

OPENSUSE-SU-2025:14854-1

Affected Products

Alt Linux

Debian

Google Chrome

Red Os

References · 65

• 🔥 https://github.com/ading2210/CVE-2024-6778-POC · Exploit
• 🔥 https://github.com/bi-zone/CVE-2024-7965 · Exploit
• 🔥 https://github.com/XiaomingX/cve-2024-7965-poc · Exploit
• 🔥 https://github.com/r00tjunip3r1/POC-CVE-2024-6778 · Exploit
• https://osv.dev/vulnerability/DSA-5875-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1915 · Security Note
• https://osv.dev/vulnerability/CVE-2025-1915 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1915 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/718833 · Security Note
• https://osv.dev/vulnerability/MGASA-2025-0091 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:0084-1 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-1915 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2025-0091.html · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:14854-1 · Vendor Advisory