Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via physical access to the device. (Chromium security severity: Low)
cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE
Google Chrome < 143.0.7499.41
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
// CVE-2025-13640 PoC - Local Authentication Bypass in Chrome Password Manager
// Note: This vulnerability requires physical access to the device
// This PoC demonstrates the conceptual attack scenario
// Attack Prerequisites:
// 1. Attacker must have physical access to the target device
// 2. Target device must be in an unlocked or logged-in state
// 3. Target Chrome version < 143.0.7499.41
// Conceptual Attack Steps:
// 1. Gain physical access to the device running vulnerable Chrome version
// 2. Open Chrome browser
// 3. Navigate to chrome://settings/passwords or Settings > Passwords
// 4. Due to the improper implementation, authentication bypass occurs
// 5. Stored passwords become accessible without proper verification
// 6. Attacker can view/export saved credentials
// Example exploitation scenario:
function exploitScenario() {
console.log("Physical Access Required");
console.log("Target: Chrome < 143.0.7499.41");
// Step 1: Access device
const hasPhysicalAccess = true;
// Step 2: Open Chrome and navigate to passwords
if (hasPhysicalAccess) {
// Navigate to chrome://settings/passwords
// In vulnerable version, passwords are accessible without auth
const passwordsAccessible = true;
if (passwordsAccessible) {
console.log("Authentication bypass successful");
console.log("Attacker can now access stored credentials");
}
}
}
// Mitigation: Update Chrome to version 143.0.7499.41 or later
// Reference: https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop.html