CVE-2025-8581 Affecting chromium package, versions <139.0.7258.66-1
Threat Intelligence
EPSS
0.27% (19th percentile)
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk IDSNYK-DEBIAN14-CHROMIUM-11739503
- published10 Aug 2025
- disclosed7 Aug 2025
Introduced: 7 Aug 2025
CVE-2025-8581 (opens in a new tab)Common Vulnerabilities and Exposures (CVE) are common identifiers for publicly known security vulnerabilities
How to fix?
Upgrade Debian:14 chromium to version 139.0.7258.66-1 or higher.
NVD Description
Note: Versions mentioned in the description apply only to the upstream chromium package and not the chromium package as distributed by Debian.
See How to fix? for Debian:14 relevant fixed versions and status.
Inappropriate implementation in Extensions in Google Chrome prior to 139.0.7258.66 allowed a remote attacker who convinced a user to engage in specific UI gestures to leak cross-origin data via a crafted HTML page. (Chromium security severity: Low)