CVE-2025-4052

Description

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low)

CVSS v3.1 Score

9.8

CRITICAL

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness Type (CWE)

CWE-838 CWE-838

Affected Products

Vendor	Product	Versions
google	chrome	< 136.0.7103.59

References

Advisories & Patches

https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop_29.html

Other References

https://issues.chromium.org/issues/401927528

Frequently Asked Questions

What is CVE-2025-4052? +

Inappropriate implementation in DevTools in Google Chrome prior to 136.0.7103.59 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass discretionary access control via a crafted HTML page. (Chromium security severity: Low) It has a CVSS v3.1 base score of 9.8 (CRITICAL).

How severe is CVE-2025-4052? +

CVE-2025-4052 has a CVSS v3.1 score of 9.8 out of 10, rated CRITICAL. This is a critical vulnerability that should be patched immediately.

What products are affected by CVE-2025-4052? +

CVE-2025-4052 affects products from google, specifically: chrome. Check the affected products table above for specific version ranges.

How do I check if I'm vulnerable to CVE-2025-4052? +

You can use Secably's free Website Scanner to check your website for known vulnerabilities. For infrastructure scanning, use the Port Scanner to identify exposed services that may be affected. Check the vendor advisories linked above for specific patch and version information.

Related Vulnerabilities

CVE-2026-53641

FOSSBilling is a free, open-source billing and client management system. Versions 0.6.0 through 0.7.2 have a stored cross-site scripting (XSS) …

CVE-2024-11702 7.5

Copying sensitive information from Private Browsing tabs on Android, such as passwords, may have inadvertently stored data in the cloud-based …

CVE-2023-5770 5.3

Proofpoint Enterprise Protection contains a vulnerability in the email delivery agent that allows an unauthenticated attacker to inject improperly encoded …

CVE-2024-34006 4.3

The site log report required additional encoding of event descriptions to ensure any HTML in the content is displayed in …

CVE-2026-0092

In Package Manager, there is a possible device lock controller bypass due to a missing permission check. This could lead …

CVE-2025-0982 10.0

Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code …