CVE-2025-11213 Overview
CVE-2025-11213 is a domain spoofing vulnerability affecting the Omnibox component in Google Chrome on Android prior to version 141.0.7390.54. The flaw stems from an inappropriate implementation in the address bar rendering logic. A remote attacker can exploit this issue by convincing a user to interact with specific UI gestures on a crafted HTML page. Successful exploitation enables the attacker to spoof the displayed domain, undermining the visual trust signals users rely on to verify website authenticity. The vulnerability is tracked under [CWE-451] (User Interface Misrepresentation of Critical Information) and carries a Chromium security severity rating of Medium.
Critical Impact
Attackers can misrepresent the domain shown in the Chrome Omnibox on Android, enabling phishing campaigns that impersonate trusted websites through crafted HTML pages and required user gestures.
Affected Products
- Google Chrome on Android prior to 141.0.7390.54
- Google Android platform running vulnerable Chrome builds
- Chromium-based browsers on Android sharing the same Omnibox implementation
Discovery Timeline
- 2025-11-06 - CVE-2025-11213 published to the National Vulnerability Database
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-11213
Vulnerability Analysis
The vulnerability resides in the Omnibox, the combined address and search bar in Google Chrome. On Android builds prior to 141.0.7390.54, the Omnibox mishandles rendering of URL content under specific user interaction sequences. The flaw belongs to the class of user interface security issues cataloged as [CWE-451], where security-relevant information is displayed to the user in a misleading way.
Exploitation requires the attacker to deliver a crafted HTML page and induce the user to perform specific UI gestures. These gestures manipulate the Omnibox state so that the address bar displays a domain that differs from the origin actually serving the page content. Because users depend on the Omnibox to verify identity before entering credentials or sensitive data, the spoofing capability directly supports phishing and credential harvesting operations.
Root Cause
The root cause is inappropriate implementation logic in the Android Omnibox that fails to enforce consistent, tamper-resistant URL display during transitions triggered by user gestures. The rendering path does not correctly synchronize the displayed domain with the true origin of the content, allowing a malicious page to influence what the address bar shows.
Attack Vector
The attack is network-based and requires user interaction. An attacker hosts a crafted HTML page and lures the target using phishing links, malvertising, or compromised sites. When the victim opens the page in Chrome on Android and performs the required gestures, the Omnibox displays a spoofed domain while the malicious content continues to execute. Reference details are available in the Chromium Issue #443408317 tracker and the Google Chrome Stable Update advisory.
No verified public proof-of-concept code exists for this issue. Technical mechanics are described in the linked Chromium issue tracker rather than reproduced here.
Detection Methods for CVE-2025-11213
Indicators of Compromise
- Inbound links or messages directing Android users to unfamiliar HTML pages that request specific taps, swipes, or long-press gestures before displaying login prompts.
- Web proxy or DNS telemetry showing Android Chrome user agents on Chrome versions prior to 141.0.7390.54 visiting newly registered or low-reputation domains.
- User reports of credential entry on pages where the perceived domain does not match backend authentication logs.
Detection Strategies
- Inventory managed Android endpoints and identify Chrome installations reporting a version earlier than 141.0.7390.54.
- Correlate mobile browsing telemetry with threat intelligence feeds covering phishing infrastructure and Omnibox spoofing lures.
- Inspect suspicious HTML samples in a sandbox for scripts that trigger navigation or history manipulation timed to user gestures.
Monitoring Recommendations
- Track Chrome for Android version distribution across the fleet and alert on devices remaining below the patched build.
- Monitor authentication systems for spikes in failed logins or logins from anomalous geolocations that could indicate credential theft following spoofing attacks.
- Ingest mobile web gateway logs into a centralized analytics platform to surface repeated visits to domains flagged in phishing feeds.
How to Mitigate CVE-2025-11213
Immediate Actions Required
- Update Google Chrome on Android to version 141.0.7390.54 or later through the Google Play Store.
- Enforce minimum Chrome versions through mobile device management (MDM) policies for corporate-managed Android devices.
- Notify users of active phishing risk and reinforce guidance to verify URLs through means other than the Omnibox when handling sensitive actions.
Patch Information
Google addressed CVE-2025-11213 in the Chrome stable channel release that shipped 141.0.7390.54 for Android. Refer to the Google Chrome Stable Update release notes and Chromium Issue #443408317 for change details. No configuration change is required beyond installing the patched Chrome build.
Workarounds
- Restrict use of vulnerable Chrome versions on Android by requiring the patched build through MDM compliance checks.
- Deploy enterprise phishing protection and DNS filtering to block known malicious domains that host crafted spoofing pages.
- Encourage users to access sensitive services through vetted mobile applications rather than the mobile browser until patching is confirmed.
# Verify installed Chrome version on a managed Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should report versionName=141.0.7390.54 or later
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
