Overview
CVE-2025-13634 is a medium severity security vulnerability found in Google Chrome on Windows. Specifically, it affects the Downloads functionality in versions prior to 143.0.7499.41. This vulnerability allows a local attacker to bypass the “Mark of the Web” (MOTW) security mechanism by crafting a malicious HTML page.
Technical Details
The vulnerability stems from an inappropriate implementation in how Chrome handles downloaded files, particularly HTML pages, on Windows systems. Mark of the Web is a Windows security feature that adds a zone identifier to files downloaded from the internet. This identifier informs Windows and applications like Internet Explorer and Edge about the origin of the file, allowing them to restrict certain functionalities to prevent malicious behavior. By successfully bypassing MOTW, an attacker can potentially execute malicious scripts or code with fewer restrictions, increasing the risk of exploitation.
The specific details of the inappropriate implementation are documented in the Chromium issue tracker (see references below).
CVSS Analysis
Currently, the CVSS score is listed as N/A. However, given the potential for local privilege escalation and code execution by bypassing security features, a proper CVSS score is crucial for accurate risk assessment. As more information becomes available, this section will be updated with the appropriate CVSS vector and score.
Possible Impact
A successful exploit of CVE-2025-13634 could allow a local attacker to:
- Execute malicious code with fewer security restrictions.
- Potentially gain unauthorized access to sensitive data.
- Compromise the security of the user’s system by bypassing security measures designed to prevent code from untrusted sources being executed.
Mitigation or Patch Steps
The vulnerability is addressed in Google Chrome version 143.0.7499.41 and later. Users are strongly advised to update their Chrome browser to the latest version to mitigate this risk. To update Chrome:
- Open Google Chrome.
- Click on the three dots (menu) in the upper right corner.
- Go to “Help” > “About Google Chrome.”
- Chrome will automatically check for updates and install them.
- Restart Chrome to complete the update process.
