Product: Chrome
Summary
Inappropriate implementation in Toolbar in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform domain spoofing via a crafted HTML page. This vulnerability has a medium severity rating and requires user interaction to exploit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-9865 |
Exploitation
To exploit this vulnerability, an attacker must convince a user to perform specific UI gestures while interacting with a crafted HTML page. This could involve tricking the user into clicking on a link or button that leads to the malicious page, which then takes advantage of the inappropriate implementation in the Toolbar to spoof domains.
Affected Products
- Google Chrome on Android prior to version 140.0.7339.80
Mitigation
Users are advised to update their Google Chrome application to the latest version to mitigate this vulnerability. Keeping software up to date is crucial in protecting against known vulnerabilities and ensuring the security of user data.