CVE-2025-12910: 
Google Chrome vulnerability analysis and mitigation

CVE-2025-12910 is a low-severity vulnerability involving an inappropriate implementation in the Passkeys feature of Google Chrome that allows a local attacker to obtain potentially sensitive information via debug logs. It affects all versions of Google Chrome prior to 140.0.7339.80 on Windows, Mac, and Linux. The vulnerability was reported by Kamaraj Gandhirajan and Anoop Pandey on 2025-07-30 and was publicly disclosed on November 7, 2025, as part of the Chrome 140 stable channel release notes. It carries a CVSS v3.1 base score of 6.2 (Medium) (Chrome Releases, Feedly).

The root cause is classified as CWE-1295 (Debug Messages Revealing Unnecessary Information), where Chrome's Passkeys implementation inappropriately writes sensitive information into debug logs accessible to local users. An attacker with local system access — but without requiring any special privileges — can read these debug log files to extract potentially sensitive Passkeys-related authentication data. No network access is required, and the attack complexity is low, making it straightforward for any local user to exploit if debug logging is enabled (Chrome Releases, Feedly).

Successful exploitation results in a high confidentiality impact, with no effect on integrity or availability. A local attacker could extract sensitive Passkeys authentication information from Chrome's debug logs, potentially exposing credentials or authentication tokens used in passwordless login flows. The scope is limited to the local system, but exposure of Passkeys data could facilitate account compromise on services where the victim uses passkey-based authentication (Feedly).

No active in-the-wild exploitation has been observed, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. A Chromium issue tracker entry (issues.chromium.org/issues/434977743) is referenced as a potential PoC source, but analysis indicates it contains no actual exploit code or reproduction steps. The EPSS score is extremely low at 0.000080, reflecting minimal likelihood of exploitation in the near term (Chrome Releases, Feedly).

1. Local Access: Gain local user-level access to a system running Google Chrome prior to version 140.0.7339.80 — no elevated privileges are required.
2. Identify Debug Log Location: Locate Chrome's debug log files on the target system (e.g., on Linux: ~/.config/google-chrome/chrome_debug.log; on Windows: %LOCALAPPDATA%\Google\Chrome\User Data\chrome_debug.log).
3. Trigger Passkeys Activity: Wait for or induce the victim user to perform a Passkeys authentication operation (e.g., logging into a website using a passkey), which causes Chrome to write sensitive information to the debug log.
4. Extract Sensitive Data: Read the debug log file and search for Passkeys-related entries that may contain sensitive authentication information such as credential identifiers or related data (Chrome Releases, Feedly).

• File System: Unexpected access or reads to Chrome debug log files (e.g., chrome_debug.log) by processes or users other than the Chrome browser or the owning user account.
• Logs: OS-level audit logs (e.g., Linux auditd, Windows Security Event Log) showing file read events on Chrome debug log paths by unauthorized local users or scripts.
• Process: Unusual scripts or processes (e.g., grep, findstr, PowerShell) querying Chrome log directories for Passkeys-related strings.

Update Google Chrome to version 140.0.7339.80 or later, which contains the fix for this vulnerability (Chrome Releases). As a workaround prior to patching, restrict local system access to prevent unauthorized users from reading Chrome's debug log files, and implement endpoint security controls to monitor access to sensitive log directories. Organizations should also enforce least-privilege access policies on shared systems where multiple local users are present (Feedly).

The vulnerability received low-severity classification from the Chromium security team and attracted minimal public attention given its local-only attack vector and low CVSS score. It was picked up by standard vulnerability aggregators including Vulners, CVEFeed, and ENISA's EUVD (EUVD-2025-38335), as well as Fedora Linux security advisories for the Chromium package. No notable researcher commentary or significant media coverage has been identified beyond routine vulnerability tracking (Feedly).