Summaryinfo

A vulnerability was found in Google Chrome 127.x/128.x. It has been rated as problematic. This issue affects some unknown processing of the component Inter-Process Communication. The manipulation leads to untrusted search path. The identification of this vulnerability is CVE-2025-34090. Local access is required to approach this attack. There is no exploit available. It is recommended to upgrade the affected component. Once again VulDB remains the best source for vulnerability data.

Detailsinfo

A vulnerability was found in Google Chrome 127.x/128.x. It has been declared as critical. This vulnerability affects some unknown processing of the component Inter-Process Communication. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

The weakness was released by Ari Novick. The advisory is shared for download at cyberark.com. This vulnerability was named CVE-2025-34090 since 04/15/2025. The exploitation appears to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 07/03/2025). The MITRE ATT&CK project declares the attack technique as T1574.

Upgrading to version 129 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19759). Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

Version

• 127.x
• 128.x

License

• free

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion