What is the CVSS score of CVE-2025-13634?

CVE-2025-13634 has a CVSS 3.1 base score of 4.4 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Which versions of Windows are affected by CVE-2025-13634?

Organizations using Downloads in Google Chrome on Windows should be aware of moderate risk from CVE-2025-13634 rated CVSS 4.4. Exploitation could compromise the security of affected deployments.. A patch is available.

How to fix or mitigate CVE-2025-13634?

Within 30 days: Identify affected systems running Downloads in Google Chrome on Windows and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

Windows CVE-2025-13634

EUVD-2025-200316 MEDIUM

Authentication Bypass by Spoofing (CWE-290)

2025-12-02 chrome-cve-admin@google.com

Windows Authentication Bypass Chrome Google Microsoft Debian Ubuntu Suse

4.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

4.4 MEDIUM

AV:L/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Ubuntu

MEDIUM

qualitative

SUSE

MEDIUM

qualitative

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 15, 2026 - 14:04 euvd

EUVD-2025-200316

Analysis Generated

Mar 15, 2026 - 14:04 vuln.today

CVE Published

Dec 02, 2025 - 19:15 nvd

MEDIUM 4.4

DescriptionCVE.org

Inappropriate implementation in Downloads in Google Chrome on Windows prior to 143.0.7499.41 allowed a local attacker to bypass mark of the web via a crafted HTML page. (Chromium security severity: Medium)

Analysis

Technical ContextAI

An authentication bypass vulnerability allows attackers to circumvent login mechanisms and gain unauthorized access without valid credentials. This vulnerability is classified as Authentication Bypass by Spoofing (CWE-290).

RemediationAI

Implement robust authentication mechanisms. Use multi-factor authentication. Review authentication logic for bypass conditions. Remove default credentials.

More in Windows

View all

CVE-2019-0803 HIGH Act Now POC

7.8 Apr 09

Windows Win32k fails to properly handle objects in memory, allowing local privilege escalation exploited in the wild in

CVE-2020-1472 MEDIUM Act Now POC

5.5 Aug 17

A privilege escalation vulnerability (CVSS 5.5). Risk factors: actively exploited (KEV-listed), EPSS 94% exploitation pr

CVE-2025-33053 HIGH Act Now POC

8.8 Jun 10

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

CVE-2025-33073 HIGH Act Now POC

8.8 Jun 10

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

CVE-2025-13315 CRITICAL Emergency POC

9.3 Nov 19

Twonky Server 8.5.2 on Linux and Windows allows unauthenticated access to the admin log file through a web service API b

CVE-2013-10047 CRITICAL Emergency POC

9.3 Aug 01

An unrestricted file upload vulnerability exists in MiniWeb HTTP Server <= Build 300 that allows unauthenticated remote

CVE-2012-10030 CRITICAL Emergency POC

9.3 Aug 05

FreeFloat FTP Server contains multiple critical design flaws that allow unauthenticated remote attackers to upload arbit

CVE-2025-34101 CRITICAL Emergency POC

9.3 Jul 10

Serviio Media Server versions 1.4 through 1.8 on Windows contain an unauthenticated command injection in the /rest/actio

CVE-2025-13316 HIGH Act Now POC

8.2 Nov 19

Twonky Server 8.5.2 uses hard-coded cryptographic keys for encrypting the administrator password. Combined with the cred

CVE-2025-34095 CRITICAL Emergency POC

9.3 Jul 10

Mako Server versions 2.5 and 2.6 contain an unauthenticated OS command injection via the tutorial interface at examples/

CVE-2025-11953 CRITICAL Act Now POC

9.8 Nov 03

React Native Metro Development Server binds to external interfaces by default and contains an OS command injection endpo

CVE-2025-24054 MEDIUM This Month POC

6.5 Mar 11

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network

Same weakness CWE-290 – Authentication Bypass by Spoofing

View all

CVE-2024-54085 CRITICAL

9.8

CVE-2023-50224 MEDIUM

6.5

CVE-2024-4358 CRITICAL POC

9.8

CVE-2018-5353 CRITICAL POC

9.8

CVE-2023-51350 CRITICAL POC

9.8

CVE-2022-3180 CRITICAL

9.8

CVE-2025-66570 CRITICAL POC

10.0

CVE-2025-49002 CRITICAL POC

9.8

Same technique Authentication Bypass

View all

CVE-2023-22515 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2013-2465 CRITICAL POC

9.8

CVE-2011-3544 CRITICAL POC

9.8

CVE-2022-40684 CRITICAL POC

9.8

CVE-2025-61882 CRITICAL POC

9.8

CVE-2024-0012 CRITICAL POC

9.3

CVE-2023-46805 HIGH POC

8.2

Vendor StatusVendor

Ubuntu

Priority: Medium

chromium-browser

Release	Status	Version
jammy	not-affected	code not present
noble	not-affected	code not present
plucky	not-affected	code not present
questing	not-affected	code not present
upstream	released	-

Debian

chromium

Release	Status	Fixed Version	Urgency
bullseye (security), bullseye	vulnerable	120.0.6099.224-1~deb11u1	-
bookworm	fixed	143.0.7499.40-1~deb12u1	-
bookworm (security)	fixed	146.0.7680.71-1~deb12u1	-
trixie	fixed	143.0.7499.40-1~deb13u1	-
trixie (security)	fixed	146.0.7680.71-1~deb13u1	-
forky	fixed	146.0.7680.71-1	-
sid	fixed	146.0.7680.80-1	-
bullseye	fixed	(unfixed)	end-of-life
(unstable)	fixed	143.0.7499.40-1	-

DSA-6072-1

SUSE

Severity: Medium

Product	Status
SUSE Package Hub 15 SP6	Fixed
openSUSE Leap 15.6	Fixed
openSUSE Tumbleweed	Fixed
SUSE Package Hub 15 SP6	Fixed

CVE-2025-13634 vulnerability details – vuln.today

Back

Windows CVE-2025-13634

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

Analysis

Technical ContextAI

RemediationAI

More in Windows

Same weakness CWE-290 – Authentication Bypass by Spoofing

Same technique Authentication Bypass

Vendor StatusVendor

Ubuntu

Debian

SUSE

Share

External POC / Exploit Code