Google Chrome 127.x/128.x Inter-Process Communication untrusted search path

Summaryinfo

A vulnerability was found in Google Chrome 127.x/128.x. It has been declared as problematic. Affected by this issue is some unknown functionality of the component Inter-Process Communication. Executing a manipulation can lead to untrusted search path. This vulnerability is handled as CVE-2025-34090. It is possible to launch the attack on the local host. There is not any exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability was found in Google Chrome 127.x/128.x. It has been declared as critical. This vulnerability affects some unknown processing of the component Inter-Process Communication. The manipulation with an unknown input leads to a untrusted search path vulnerability. The CWE definition for the vulnerability is CWE-426. The product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers. Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

The weakness was released by Ari Novick. The advisory is shared for download at cyberark.com. This vulnerability was named CVE-2025-34090 since 04/15/2025. The exploitation appears to be difficult. The attack needs to be approached locally. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $5k-$25k (estimation calculated on 07/03/2025). The MITRE ATT&CK project declares the attack technique as T1574.

Upgrading to version 129 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-19759). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Web Browser

Vendor

• Google

Name

• Chrome

Version

• 127.x
• 128.x

License

• free

Website

• Vendor: https://www.google.com/
• Product: https://www.google.com/chrome/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion