CVE-2025-11216: Google Chrome Domain Spoofing Vulnerability

CVE-2025-11216 Overview

CVE-2025-11216 is a domain spoofing vulnerability in the Storage component of Google Chrome on macOS. The flaw affects Chrome versions prior to 141.0.7390.54 and stems from an inappropriate implementation that a remote attacker can trigger via a crafted video file. Chromium classifies the security severity as Low, while NVD assigns a medium CVSS score. Successful exploitation requires user interaction, such as opening or navigating to attacker-controlled content. The issue enables the attacker to spoof the perceived origin, which undermines the security assumptions users and web applications place on the address bar and origin-based access controls.

Critical Impact
Remote attackers can perform domain spoofing on macOS Chrome users by delivering a crafted video file, weakening origin trust boundaries used across the web platform.

Affected Products

Google Chrome on macOS versions prior to 141.0.7390.54
Apple macOS running vulnerable Chrome builds
Chromium-based workflows that rely on Chrome Storage origin isolation on macOS

Discovery Timeline

2025-11-06 - CVE-2025-11216 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-11216

Vulnerability Analysis

The vulnerability resides in Chrome's Storage component on macOS. According to the Chromium project, an inappropriate implementation allows a remote attacker to perform domain spoofing when a user interacts with a crafted video file. Domain spoofing weakens the same-origin model that browsers use to isolate web content. When origin attribution is unreliable, users may trust content that appears to come from a legitimate site while it is actually served or influenced by an attacker. The NVD entry lists the CWE as NVD-CWE-noinfo, indicating that detailed weakness classification was not published. Chrome's own risk rating is Low, but the network-reachable nature of the flaw and the impact on browser security guarantees justify treating it as a meaningful defense-in-depth fix. Additional technical context is available in the Chromium Issue Tracker Entry.

Root Cause

The root cause is an implementation error in how the Storage subsystem handles a specially crafted video resource. The handling logic fails to correctly bind stored or displayed content to its true origin, which allows the browser to present or attribute content in a way that misrepresents the source domain.

Attack Vector

The attack is network-based and requires user interaction. An attacker hosts a crafted video file on a page under their control and lures the target to load it in Chrome on macOS. Once loaded, the flaw causes Chrome to misrepresent origin information, enabling spoofing scenarios such as phishing pages that appear to originate from a trusted domain.

No verified proof-of-concept code is available for CVE-2025-11216. Refer to the Chromium Issue Tracker Entry and the Google Chrome Desktop Update for authoritative technical details.

Detection Methods for CVE-2025-11216

Indicators of Compromise

Chrome browser process on macOS loading unexpected .mp4, .webm, or other video resources from low-reputation domains immediately before credential entry.
User reports of address-bar domain mismatches or unexpected origin behavior on pages containing embedded video.
Chrome installations on macOS with version strings older than 141.0.7390.54 in managed inventory data.

Detection Strategies

Inventory managed macOS endpoints and flag Chrome versions below 141.0.7390.54 for prioritized patching.
Correlate proxy or DNS logs for macOS clients requesting video content from newly registered or uncategorized domains followed by authentication events.
Monitor for phishing campaigns leveraging video-embedded landing pages that target macOS Chrome users.

Monitoring Recommendations

Track Chrome version telemetry from endpoint agents and alert when hosts drift below the patched build 141.0.7390.54.
Enable browser security event logging where available and forward it to your SIEM for spoofing and phishing correlation.
Watch for anomalous credential submissions from macOS users following recent video-content navigation events.

How to Mitigate CVE-2025-11216

Immediate Actions Required

Update Google Chrome on macOS to version 141.0.7390.54 or later on all managed and unmanaged endpoints.
Force-restart Chrome after the update so the patched binary is loaded in place of the vulnerable running process.
Reinforce user awareness on verifying URLs and certificate details before entering credentials, especially after video playback.

Patch Information

Google fixed the issue in the Chrome Stable channel for desktop. See the Google Chrome Desktop Update advisory for release details. Upgrading Chrome on macOS to 141.0.7390.54 or later remediates CVE-2025-11216.

Workarounds

Deploy Chrome enterprise policies to enforce automatic updates and minimum version requirements on macOS fleets.
Restrict access to untrusted sites hosting video content through web filtering until patching is complete.
Advise users to avoid opening video links from unknown senders on macOS Chrome installs that cannot be updated immediately.

bash

# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version

# Expected patched output (or newer):
# Google Chrome 141.0.7390.54