CVE-2025-4609

Upstream information

CVE-2025-4609 at MITRE

Description

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)

---

Other Security Trackers

• EUVD-2025-25768

SUSE information

Overall state of this security issue: Resolved

This issue is currently rated as having critical severity.

CVSS v3 Scores

	CNA (CISA-ADP)
Base Score	9.6
Vector	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Attack Vector	Network
Attack Complexity	Low
Privileges Required	None
User Interaction	Required
Scope	Changed
Confidentiality Impact	High
Integrity Impact	High
Availability Impact	High
CVSSv3 Version	3.1

SUSE Bugzilla entry: 1243205 [RESOLVED / FIXED]

SUSE Security Advisories:

• openSUSE-SU-2025:15143-1, published Thu May 22 18:51:55 2025
• openSUSE-SU-2025:15182-1, published Sat May 31 18:50:27 2025

List of released packages

Product(s)	Fixed package version(s)	References
SUSE Package Hub 15 SP6	chromedriver >= 136.0.7103.113-bp156.2.119.1 chromium >= 136.0.7103.113-bp156.2.119.1	Patchnames: openSUSE-2025-157
openSUSE Leap 15.6	chromedriver >= 136.0.7103.113-bp156.2.119.1 chromium >= 136.0.7103.113-bp156.2.119.1	Patchnames: openSUSE-2025-157
openSUSE Tumbleweed	chromedriver >= 136.0.7103.113-1.1 chromium >= 136.0.7103.113-1.1 nodejs-electron >= 35.5.0-1.1 nodejs-electron-devel >= 35.5.0-1.1 nodejs-electron-doc >= 35.5.0-1.1	Patchnames: openSUSE-Tumbleweed-2025-15143 openSUSE-Tumbleweed-2025-15182

---

SUSE Timeline for this CVE

CVE page created: Thu May 15 00:15:05 2025
CVE page last modified: Tue Aug 26 12:27:55 2025