CVE-2025-12435 Overview
CVE-2025-12435 is a user interface spoofing vulnerability affecting Google Chrome on Android prior to version 142.0.7444.59. The flaw resides in the Omnibox component, which handles the address bar display and URL rendering. A remote attacker can craft an HTML page that manipulates the security UI, misleading users about the actual origin of the content they view. Google classified this issue under CWE-285: Improper Authorization with a Chromium security severity rating of Medium.
Critical Impact
Attackers can spoof security indicators in the Chrome Android Omnibox, enabling convincing phishing pages that display trusted URLs while serving attacker-controlled content.
Affected Products
- Google Chrome for Android prior to 142.0.7444.59
- Google Android devices running vulnerable Chrome builds
- Chromium-based mobile browsers sharing the Omnibox component
Discovery Timeline
- 2025-11-10 - CVE-2025-12435 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-12435
Vulnerability Analysis
The vulnerability affects the Omnibox in Google Chrome for Android. The Omnibox combines the URL bar and search input, and it renders security indicators such as the site origin and connection status. A crafted HTML page can manipulate how the Omnibox displays this information, producing a mismatch between the URL shown to the user and the content actually loaded.
User interface spoofing attacks like this one target the trust boundary between browser chrome and page content. Mobile browsers face greater exposure because the smaller viewport truncates URLs and hides visual cues that desktop users rely on to detect deception. Successful exploitation requires user interaction, such as visiting the attacker's page, but no privileges or authentication.
Google addressed the flaw in the Chrome 142 stable channel release documented in the Chrome Releases blog. Additional engineering context is tracked in the Chromium Issue Tracker entry 446463993.
Root Cause
The root cause is improper handling of navigation state or URL rendering within the Android Omnibox implementation. The component fails to correctly reflect the actual security context of the rendered document, allowing attacker-supplied HTML to influence indicators intended to convey trust.
Attack Vector
An attacker hosts a malicious HTML page and lures a target to visit it through phishing, malicious advertising, or a compromised site. The crafted page triggers the Omnibox spoofing condition. The user sees a legitimate-looking URL or security indicator while interacting with attacker-controlled content, which enables credential theft or malware delivery. No verified proof-of-concept code is publicly available at this time.
Detection Methods for CVE-2025-12435
Indicators of Compromise
- Mobile users reporting URL bar behavior inconsistent with the destination site
- Access logs showing Chrome on Android user agents prior to 142.0.7444.59 visiting suspicious HTML pages
- Phishing pages using non-standard navigation patterns, iframe nesting, or history manipulation to influence the Omnibox
Detection Strategies
- Inventory managed Android devices and identify Chrome installations reporting versions below 142.0.7444.59 through mobile device management telemetry.
- Monitor web proxy and DNS telemetry for known phishing infrastructure targeting employees on mobile devices.
- Correlate credential submission events with Chrome Android user agents on unversioned or outdated builds.
Monitoring Recommendations
- Track Chrome for Android version distribution across the mobile fleet and alert on devices lagging the stable channel.
- Ingest browser and proxy logs into a centralized analytics platform to identify anomalous referral chains consistent with UI spoofing.
- Review user-reported phishing submissions for mobile-specific characteristics that could indicate exploitation.
How to Mitigate CVE-2025-12435
Immediate Actions Required
- Update Google Chrome on Android to version 142.0.7444.59 or later through Google Play Store.
- Push forced updates via enterprise mobility management for corporate-owned or managed Android devices.
- Communicate phishing awareness guidance to mobile users, emphasizing verification of destinations beyond the URL bar.
Patch Information
Google released the fix in Chrome 142 stable channel. See the Google Chrome Stable Update announcement for full release notes. Users should confirm their installed version through Chrome's chrome://version page or the Play Store update listing.
Workarounds
- Restrict browsing to known, trusted domains on mobile devices until the patched Chrome build is deployed.
- Enable Google Safe Browsing Enhanced Protection to increase detection of malicious pages that could leverage the flaw.
- Deploy mobile threat defense policies that flag outdated browser versions and block access to sensitive corporate resources.
# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
