CVE-2025-0996: Google Chrome XSS Vulnerability

CVE-2025-0996 Overview

CVE-2025-0996 is a URL bar spoofing vulnerability in Google Chrome on Android. The flaw stems from an inappropriate implementation in the Browser UI component. It affects Chrome for Android versions prior to 133.0.6943.98. A remote attacker can spoof the contents of the Omnibox (URL bar) by serving a crafted HTML page. Chromium classifies the internal security severity as High, while NVD scores it Medium with a CVSS 3.1 base score of 5.4. The weakness is categorized under CWE-1007: Insufficient Visual Distinction of Homoglyphs Presenting to User. Successful exploitation enables convincing phishing scenarios where victims trust the displayed URL of an attacker-controlled page.

Critical Impact
Attackers can display a trusted URL in the Chrome for Android address bar while serving attacker-controlled content, enabling credential theft and phishing.

Affected Products

Google Chrome for Android versions prior to 133.0.6943.98
Mobile browsing sessions relying on Omnibox URL verification
Downstream Chromium-based Android browsers that ship the pre-133 Browser UI code

Discovery Timeline

2025-02-15 - CVE-2025-0996 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-0996

Vulnerability Analysis

The vulnerability resides in the Browser UI layer of Chrome for Android. The Omnibox is the primary trust indicator that users rely on to verify the origin of the page they are viewing. An inappropriate implementation in how the Browser UI renders or updates the URL bar allows a crafted HTML page to influence displayed content. The result is a mismatch between the origin of the loaded document and the URL shown to the user. User interaction is required, since the victim must navigate to an attacker-controlled page. No privileges are required, and the attack is delivered over the network. The impact is limited to confidentiality and integrity of the browser's UI trust boundary. The flaw does not permit direct code execution or sandbox escape.

Root Cause

The root cause is an insufficient visual distinction and state-handling defect in the Omnibox rendering logic, tracked under [CWE-1007]. The Browser UI does not consistently reflect the true origin of the active document when specific HTML constructs manipulate navigation or rendering timing. See the Chromium Issue Tracker Entry for the vendor's tracking record.

Attack Vector

An attacker hosts a crafted HTML page and lures a mobile Chrome user to visit it through phishing, malvertising, or a compromised site. When the page loads, it manipulates navigation or UI state so the Omnibox displays a URL belonging to a trusted domain instead of the attacker's domain. The victim then interacts with the page believing they are on a legitimate site. Attackers typically pair the spoof with a cloned login form to harvest credentials or push malicious downloads.

No verified public exploit code is available. Refer to the Google Chrome Release Update for vendor-published details.

Detection Methods for CVE-2025-0996

Indicators of Compromise

Mobile users reporting login prompts on domains where they did not intend to authenticate
Outbound requests from Android devices to newly registered domains hosting cloned brand pages
Chrome for Android build strings below 133.0.6943.98 observed in device inventory or User-Agent telemetry

Detection Strategies

Inventory Chrome for Android versions across managed devices and flag builds earlier than 133.0.6943.98
Correlate mobile web proxy logs with threat intelligence feeds for phishing infrastructure targeting your brand
Alert on referrer chains where users transition from unknown domains to credential submission endpoints

Monitoring Recommendations

Ingest mobile browser telemetry and MDM version data into a centralized analytics pipeline for continuous version compliance monitoring
Track user-reported phishing incidents that reference legitimate-looking URLs viewed on Android devices
Monitor DNS and TLS SNI logs for lookalike domains impersonating internal authentication portals

How to Mitigate CVE-2025-0996

Immediate Actions Required

Update Google Chrome for Android to version 133.0.6943.98 or later through the Google Play Store
Enforce minimum Chrome version policies via Mobile Device Management (MDM) for corporate Android fleets
Communicate phishing awareness reminders emphasizing that the URL bar alone is not a sufficient trust indicator on outdated builds

Patch Information

Google fixed the issue in Chrome 133.0.6943.98 for Android. The patch is delivered through standard Chrome update channels on the Google Play Store. See the Google Chrome Release Update and the Chromium Issue Tracker Entry for release details.

Workarounds

Restrict browsing to trusted enterprise portals through a managed browser configuration until updates are deployed
Deploy phishing-resistant authentication such as FIDO2 security keys to blunt credential theft from spoofed pages
Route mobile traffic through a secure web gateway that blocks known phishing domains

bash

# Verify Chrome for Android version via ADB on a managed device
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should show versionName=133.0.6943.98 or higher