CVE-2025-0440: Google Chrome UI Spoofing Vulnerability

CVE-2025-0440 Overview

CVE-2025-0440 is a user interface (UI) spoofing vulnerability in the Fullscreen component of Google Chrome on Windows. Versions prior to 132.0.6834.83 contain an inappropriate implementation that allows a remote attacker to trick users through a crafted HTML page. The flaw is categorized under [CWE-290] Authentication Bypass by Spoofing and requires user interaction to succeed. Google classified the Chromium security severity as Medium. Successful exploitation can mislead users into trusting attacker-controlled content rendered in fullscreen mode, enabling phishing, credential theft, or unauthorized actions initiated by the victim.

Critical Impact
Attackers can craft HTML pages that abuse fullscreen behavior to spoof legitimate browser UI, deceiving users into interacting with malicious content that appears trustworthy.

Affected Products

Google Chrome on Windows prior to 132.0.6834.83
Microsoft Windows platforms running affected Chrome builds
Chromium-based browsers sharing the vulnerable Fullscreen implementation

Discovery Timeline

2025-01-15 - CVE-2025-0440 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Reference: Google Chrome Desktop Update and Chromium Issue Tracker Entry.

Technical Details for CVE-2025-0440

Vulnerability Analysis

The vulnerability resides in Chrome's Fullscreen API implementation on Windows. When a page enters fullscreen mode, the browser is expected to render clear indicators that trusted browser chrome is no longer visible. The inappropriate implementation allows a crafted HTML page to manipulate rendering in a way that obscures or spoofs these indicators. Attackers can present fake address bars, security prompts, or operating system dialogs that appear authentic to the user. Because the spoofed content executes within the legitimate browser process, standard visual trust cues fail. This flaw maps to [CWE-290] and depends on user interaction, such as clicking a link or button, to trigger the fullscreen transition.

Root Cause

The root cause is the browser's failure to enforce consistent visual security boundaries during fullscreen transitions and rendering. Chrome does not adequately restrict how content can position or style elements that mimic browser UI while the tab occupies the full screen. This gap in the security model of the Fullscreen API permits attacker-controlled HTML and CSS to imitate trusted interface elements.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a malicious page or injects crafted HTML into a compromised site. When a victim visits the page and triggers a gesture such as a click, the page invokes the Fullscreen API. The attacker then renders a spoofed interface that impersonates the browser's address bar, an operating system login prompt, or a security warning. The victim, believing the interface is legitimate, may enter credentials, approve permissions, or download attacker-controlled files. No privileges are required on the target system, and confidentiality of browser-managed data is not directly impacted, but integrity of user decisions is compromised.

Because no verified proof-of-concept has been published, refer to the Chromium Issue Tracker Entry for restricted technical details.

Detection Methods for CVE-2025-0440

Indicators of Compromise

Browser telemetry showing frequent or automated requestFullscreen() calls from newly visited domains
User reports of unexpected fullscreen transitions immediately followed by credential or permission prompts
Outbound connections to newly registered or low-reputation domains hosting HTML pages that request fullscreen

Detection Strategies

Inspect web proxy and DNS logs for user navigation to suspicious domains preceding credential submissions or file downloads
Correlate browser process activity with unusual full-screen window states on Windows endpoints running Chrome versions earlier than 132.0.6834.83
Deploy phishing-aware email and URL filtering to reduce the delivery of crafted HTML pages that leverage this technique

Monitoring Recommendations

Track Chrome version distribution across the fleet and alert on installs below 132.0.6834.83
Monitor endpoint logs for browser child processes rendering full-screen content shortly after link clicks in mail or chat clients
Enable and review browser enterprise reporting for Safe Browsing warnings and download events tied to sessions in fullscreen mode

How to Mitigate CVE-2025-0440

Immediate Actions Required

Update Google Chrome on all Windows endpoints to version 132.0.6834.83 or later
Restart browser sessions after deployment to ensure the patched binaries are loaded
Communicate awareness guidance to users, instructing them to press Esc or F11 before entering credentials when a page unexpectedly enters fullscreen

Patch Information

Google addressed CVE-2025-0440 in the Chrome Stable channel update for Desktop released as version 132.0.6834.83. Enterprises using managed Chrome deployments should push the update through Google Update, Microsoft Intune, or SCCM. Details are available in the Google Chrome Desktop Update advisory.

Workarounds

Enforce Chrome auto-update via the ChromeAutoUpdateUpdatePolicyOverride group policy to prevent version drift
Use the FullscreenAllowed enterprise policy to restrict fullscreen mode where business use cases do not require it
Train users to recognize legitimate operating system prompts versus in-page content and to verify URLs before submitting credentials

bash

# Configuration example: disable fullscreen via Chrome enterprise policy on Windows
reg add "HKLM\SOFTWARE\Policies\Google\Chrome" /v FullscreenAllowed /t REG_DWORD /d 0 /f