My originally scheduled for release on December 15, 2025, it was released ahead of schedule!
Stable Channel Update for Desktop – Wednesday, December 10, 2025
Preface: About Google browser (The Storage Architecture): A Database, Not Just a Flat File . Chrome stores login data, including usernames, the website URL, and the encrypted password, in a local SQLite database file named Login Data. This is a structured database, not just a raw file opened and read with basic I/O or mmap() for the specific password fields.
Background: Chrome browser temporarily holds decrypted passwords in memory for a short duration when the user is actively logged in and using the browser. This design choice is fundamental to the “autofill” functionality and allows for a seamless login experience, but it introduces a specific, nuanced security consideration.
When a user visits a website and Chrome needs to autofill credentials, or when the user views their passwords in the settings, the necessary data is retrieved from the encrypted database and decrypted in memory only for that specific, immediate use.
Important: The Necessity of In-Memory Decryption
The core of your query lies in the operational phase. When you visit a website that requires a login, Chrome must retrieve the stored, encrypted password, decrypt it using the relevant OS-level key, and then inject the actual plaintext password into the login form for the autofill feature to work.
Vulnerability details: (CVE-2025-14372) Use after free in Password Manager.
Key points related to this design flaw:
- Structured Storage: Chrome uses a SQLite database (Login Data) for credentials, not a flat file. This means any memory-related flaw could impact query execution rather than raw file reads.
- Multi-Layered Decryption: Chrome leverages OS-level APIs (e.g., DPAPI on Windows, Keychain on macOS) for decrypting passwords, so the vulnerability likely affects intermediate steps rather than the final decryption logic.
- SQLite Vulnerability: The aggregate term overflow issue is real and could lead to memory corruption if Chrome’s query patterns trigger it.
Official announcement: Please refer to the link for details –
https://chromereleases.googleblog.com/2025/12/stable-channel-update-for-desktop_10.html