Product: Chrome
Summary
Inappropriate implementation in Downloads in Google Chrome on Android prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. This vulnerability has a medium severity rating and can lead to user deception.
Details
| Severity | Base Score | CVE |
|---|---|---|
| MEDIUM | 5.4 | CVE-2025-9867 |
Exploitation
To exploit this vulnerability, an attacker can create a malicious HTML page that, when accessed by a user, can manipulate the user interface of the Chrome browser. This requires the user to interact with the page, making user interaction a critical component of the attack. Once the user is tricked into interacting with the crafted page, the attacker can spoof UI elements to mislead the user.
Affected Products
- Google Chrome on Android: Vulnerable versions prior to 140.0.7339.80 allow for UI spoofing through crafted HTML pages.
Mitigation
To mitigate this vulnerability, users should update their Google Chrome browser to the latest version. Regularly updating software helps protect against known vulnerabilities and exploits. Additionally, users should exercise caution when interacting with unknown or suspicious web pages.