cvelistv5 - CVE-2025-34090

CVE-2025-34090 (GCVE-0-2025-34090)

Vulnerability from cvelistv5

Neither filed by Chrome nor a valid security vulnerability.

{
  "containers": {
    "cna": {
      "providerMetadata": {
        "dateUpdated": "2025-07-24T01:25:41.316Z",
        "orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28",
        "shortName": "Chrome"
      },
      "rejectedReasons": [
        {
          "lang": "en",
          "value": "Neither filed by Chrome nor a valid security vulnerability."
        }
      ]
    }
  },
  "cveMetadata": {
    "assignerOrgId": "83251b91-4cc7-4094-a5c7-464a1b83ea10",
    "assignerShortName": "VulnCheck",
    "cveId": "CVE-2025-34090",
    "datePublished": "2025-07-02T19:25:13.805Z",
    "dateRejected": "2025-07-24T01:25:41.316Z",
    "dateReserved": "2025-04-15T19:15:22.551Z",
    "dateUpdated": "2025-07-24T01:25:41.316Z",
    "state": "REJECTED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "nvd": "{\"cve\":{\"id\":\"CVE-2025-34090\",\"sourceIdentifier\":\"chrome-cve-admin@google.com\",\"published\":\"2025-07-02T20:15:30.110\",\"lastModified\":\"2025-07-24T07:15:52.967\",\"vulnStatus\":\"Rejected\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Rejected reason: Neither filed by Chrome nor a valid security vulnerability.\"}],\"metrics\":{},\"references\":[]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"providerMetadata\": {\"orgId\": \"ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28\", \"shortName\": \"Chrome\", \"dateUpdated\": \"2025-07-24T01:25:41.316Z\"}, \"rejectedReasons\": [{\"lang\": \"en\", \"value\": \"Neither filed by Chrome nor a valid security vulnerability.\"}]}}",
      "cveMetadata": "{\"cveId\": \"CVE-2025-34090\", \"assignerOrgId\": \"83251b91-4cc7-4094-a5c7-464a1b83ea10\", \"state\": \"REJECTED\", \"assignerShortName\": \"VulnCheck\", \"dateReserved\": \"2025-04-15T19:15:22.551Z\", \"datePublished\": \"2025-07-02T19:25:13.805Z\", \"dateUpdated\": \"2025-07-24T01:25:41.316Z\", \"dateRejected\": \"2025-07-24T01:25:41.316Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

ghsa-763x-q553-5w8v

Vulnerability from github

Published

2025-07-02 21:32

Modified

2025-07-02 21:32

Severity ?

9.3 (Critical) - CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Details

A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome's elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers.

Confirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2025-34090"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-276"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2025-07-02T20:15:30Z",
    "severity": "CRITICAL"
  },
  "details": "A security bypass vulnerability exists in Google Chrome AppBound cookie encryption mechanism due to insufficient validation of COM server paths during inter-process communication. A local low-privileged attacker can hijack the COM class identifier (CLSID) registration used by Chrome\u0027s elevation service and point it to a non-existent or malicious binary. When this hijack occurs, Chrome silently falls back to the legacy cookie encryption mechanism (protected only by user-DPAPI), thereby enabling cookie decryption by any user-context malware without SYSTEM-level access. This flaw bypasses the protections intended by the AppBound encryption design and allows cookie theft from Chromium-based browsers.\n\nConfirmed in Google Chrome with AppBound Encryption enabled. Other Chromium-based browsers may be affected if they implement similar COM-based encryption mechanisms.",
  "id": "GHSA-763x-q553-5w8v",
  "modified": "2025-07-02T21:32:00Z",
  "published": "2025-07-02T21:32:00Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2025-34090"
    },
    {
      "type": "WEB",
      "url": "https://vulncheck.com/advisories/google-chrome-appbound-cookie-encryption"
    },
    {
      "type": "WEB",
      "url": "https://www.cyberark.com/resources/threat-research-blog/c4-bomb-blowing-up-chromes-appbound-cookie-encryption"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

fkie_cve-2025-34090

Vulnerability from fkie_nvd

Published

2025-07-02 20:15

Modified

2025-07-24 07:15

Severity ?

Summary

Rejected reason: Neither filed by Chrome nor a valid security vulnerability.

References

▼	URL	Tags

Impacted products

	Vendor	Product	Version