CVE-2025-12447: Google Chrome XSS Vulnerability

CVE-2025-12447 Overview

CVE-2025-12447 is a user interface spoofing vulnerability in the Omnibox component of Google Chrome on Android. Versions prior to 142.0.7444.59 are affected. A remote attacker can trick a user into performing specific UI gestures on a crafted HTML page, leading to spoofed security indicators in the browser address bar. Chromium classifies this issue under CWE-306: Missing Authentication for Critical Function and rates its internal severity as Low. The flaw supports phishing and social engineering scenarios by allowing attackers to misrepresent the origin or trust level of a page.

Critical Impact
Attackers can manipulate the Chrome Omnibox on Android to display misleading origin or security information, increasing phishing success rates against users who rely on the address bar to verify site authenticity.

Affected Products

Google Chrome for Android prior to version 142.0.7444.59
Google Android devices running vulnerable Chrome builds
Chromium-based components inheriting the affected Omnibox code

Discovery Timeline

2025-11-10 - CVE-2025-12447 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12447

Vulnerability Analysis

The vulnerability resides in the Chrome Omnibox on Android, the combined address and search bar that users rely on to identify the origin of the current page. Chrome renders incorrect security UI when a crafted HTML page triggers specific user interface gestures. Because the Omnibox is the primary trust indicator on mobile, incorrect rendering weakens the user's ability to distinguish legitimate origins from attacker-controlled content.

Exploitation requires user interaction and specific timing between page content and gestures, which raises the attack complexity. The impact is limited to confidentiality and availability of trust signals rather than direct code execution. The issue is categorized as a User Interface Confusion class flaw and is tracked under Chromium Issue #442636157.

Root Cause

The root cause is inconsistent state handling between page navigation events, gesture handling, and Omnibox rendering. Under specific gesture sequences, the Omnibox displays URL or security state information that does not match the content actually rendered in the viewport. This desynchronization allows a malicious page to influence what the address bar shows.

Attack Vector

An attacker hosts a crafted HTML page and lures a mobile Chrome user to visit it. The page uses scripted content and prompts the user to perform gestures such as taps, swipes, or scrolls. When the gesture sequence executes, the Omnibox reflects attacker-influenced content, enabling UI spoofing suitable for credential phishing or fake security prompts.

No verified proof-of-concept code is published. The vulnerability mechanism is described in the Google Chrome release notes and the associated Chromium tracker.

Detection Methods for CVE-2025-12447

Indicators of Compromise

Chrome for Android versions below 142.0.7444.59 present on managed mobile fleets
User reports of address bar content that does not match visible page content
Inbound links from phishing campaigns that specifically target mobile Chrome users with gesture-driven landing pages

Detection Strategies

Inventory Chrome for Android versions through mobile device management (MDM) and flag builds prior to 142.0.7444.59
Monitor web proxy and DNS logs for known phishing domains delivering mobile-optimized HTML with gesture-based interactions
Correlate user-reported phishing incidents with mobile user agents to identify targeted Omnibox spoofing attempts

Monitoring Recommendations

Enforce automatic Chrome updates on Android through enterprise mobility policies
Track credential submission events to unfamiliar domains originating from mobile browsers
Review anti-phishing telemetry for pages that request gestures such as tap-hold or swipe before displaying content

How to Mitigate CVE-2025-12447

Immediate Actions Required

Update Google Chrome on Android to version 142.0.7444.59 or later through the Google Play Store
Push the updated Chrome build to managed devices using MDM policies
Communicate phishing awareness guidance to mobile users, emphasizing verification beyond the address bar

Patch Information

Google addressed CVE-2025-12447 in Chrome 142.0.7444.59 for Android. Full details are available in the Google Chrome Stable Channel Update and the Chromium tracker entry. Users should verify the installed Chrome version under Settings and confirm it meets or exceeds the patched build.

Workarounds

Restrict browsing on Android to trusted domains until the patched Chrome version is deployed
Enable Google Safe Browsing Enhanced Protection to increase warnings on suspicious pages
Use enterprise browser policies to block unknown or newly registered domains on mobile endpoints

bash

# Verify installed Chrome version on Android via ADB
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for patched builds:
# versionName=142.0.7444.59 (or later)