CVE-2025-8881: Google Chrome · Inappropriate Implementation
Affects Google ChromeSource CVE Database V5
Not known to be exploited · CVSS 6.5 Medium.
Data as of 26 Oct 2026, 08:30 UTC
- EPSS
- 0.2% chance of exploitation in 30 days – higher than 15% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 13 Aug 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Google Chrome | Affected
| Fixed in– |
AI-suggested
To mitigate the risks posed by CVE-2025-8881, European organizations should prioritize updating Google Chrome to version 139.0.7258.127 or later as soon as the patch becomes available. Until the patch is applied, organizations should implement targeted user awareness campaigns to educate users about the risks of interacting with untrusted or suspicious web content, emphasizing caution with unexpected UI prompts or gestures. Network-level controls such as web filtering and blocking access to known malicious sites can reduce exposure to crafted HTML pages designed to exploit this vulnerability. Security teams should monitor browser usage and consider deploying browser management policies that restrict or control the use of extensions and plugins that might facilitate exploitation. Additionally, organizations should review and enhance their incident detection capabilities to identify unusual data exfiltration patterns that could indicate exploitation attempts. For high-risk environments, consider using browser isolation technologies or alternative browsers with different security postures until the vulnerability is fully remediated.
Description
Inappropriate implementation in File Picker in Google Chrome prior to 139.0.7258.127 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Medium)