CVE-2025-12436
Overview
What the public commits show
2061e6224f53 ("[Extensions] Update debugger API entry in security FAQ"), rewrites the Extensions security FAQ to state that the debugger permission can, through some Chrome DevTools Protocol methods, sidestep host permissions or file access, which is why it carries a broad install warning. It is a documentation change. The public bug report describes tabCapture capturing a tab after it navigates to a local file:// page without file permission.
These commits cite this CVE's bug, but none of them contains a code change that removes the vulnerability, so no root-cause analysis is published. If the code fix later becomes public (or is identified under another bug), it will be analyzed then.
Files Changed
extensions/docs/security_faq.md
Patch
From 2061e6224f53dfff08dc3117c860e6b9e4d658ee Mon Sep 17 00:00:00 2001
From: Devlin Cronin <rdevlin.cronin@chromium.org>
Date: Wed, 17 Sep 2025 16:43:14 -0700
Subject: [PATCH] [Extensions] Update debugger API entry in security FAQ
Bug: 40054742
Change-Id: I6e91b89e2b075eb16e8567b5c76ea8da3364fb30
Reviewed-on: https://chromium-review.googlesource.com/c/chromium/src/+/6961403
Commit-Queue: Devlin Cronin <rdevlin.cronin@chromium.org>
Reviewed-by: Chris Thompson <cthomp@chromium.org>
Cr-Commit-Position: refs/heads/main@{#1516943}
---
diff --git a/extensions/docs/security_faq.md b/extensions/docs/security_faq.md
index ba9895d..11e9549f 100644
--- a/extensions/docs/security_faq.md
+++ b/extensions/docs/security_faq.md
@@ -421,10 +421,17 @@
### What privileges does the Debugger permission grant an extension? What privileges should it lack?
-The debugger permission should grant an extension the power to automate any
-website. This may extend to driving interactions with that site which are not
-possible using JavaScript on the site itself, but instead normally require
-user interaction with Chrome features.
+The debugger permission grants an extension with access to the Chrome DevTools
+Protocol, which is a powerful API surface that has many different capabilities.
+This allows an extension to automate or debug any website, and may extend to
+driving interactions with that site which are not possible using JavaScript on
+the site itself, but instead normally require user interaction with Chrome
+features.
+
+Through the use of certain methods in the Chrome DevTools Protocol, the
+debugger API *may* in some cases also sidestep other typical restrictions, such
+as host permissions or file access. This is the reason for the broad security
+warning associated with the debugger API.
The debugger permission does not allow automating parts of the Chromium
browser unrelated to websites. Automating WebUI or settings, installing
Original Bug Report
Reading local files through an extension that doesn't have the file permission
VULNERABILITY DETAILS
The “tabCapture” permission allows capturing the visible area of a given tab, but doesn’t seem to block the capture when the tab gets redirected to a local file - which allows an attacker to leak its contents even though the file permission was not given.
VERSION
Chrome Version: 88.0.4324.150 (Official Build) (64-bit)
Operating System: Windows 10
REPRODUCTION CASE
- Download extension.zip and load it into Chrome.
- Make sure you have the file permission disabled for the extension.
- Click on the extension’s icon on the Chrome toolbar.
- After a few seconds, the contents of file:///C:/ will be shown inside a video tag. This information can be exfiltrated to the attacker’s server.
Here’s an unlisted video demonstrating the issue:
https://youtu.be/sKfKbhOLDKo
CREDIT INFORMATION
Reporter credit: Luan Herrera (@lbherrera_)
