CVE-2025-12728: Google Chrome XSS Vulnerability

CVE-2025-12728 Overview

CVE-2025-12728 is a user interface spoofing vulnerability in the Omnibox component of Google Chrome on Android. The flaw affects Chrome versions prior to 142.0.7444.137. A remote attacker can exploit this issue by serving a crafted HTML page and convincing a user to perform specific UI gestures. Successful exploitation allows the attacker to manipulate what the user sees in the address bar, enabling phishing and credential theft scenarios. Google classifies the Chromium security severity as Medium and tracks the underlying issue as Chromium bug #452392032. The weakness is categorized under CWE-451: User Interface (UI) Misrepresentation of Critical Information.

Critical Impact
Attackers can spoof the Omnibox address bar on Android, deceiving users into trusting malicious pages that appear to originate from legitimate domains.

Affected Products

Google Chrome on Android prior to 142.0.7444.137
Google Chrome on desktop platforms (Windows, macOS, Linux) covered by the same Stable Channel update
Downstream Chromium-based Android browsers that inherit the Omnibox implementation

Discovery Timeline

2025-11-10 - CVE-2025-12728 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12728

Vulnerability Analysis

The vulnerability resides in the Omnibox, the combined address and search bar in Google Chrome. On Android, the Omnibox is the primary trust indicator users rely on to confirm the origin of a page. An inappropriate implementation allows a crafted HTML page to alter or misrepresent the displayed URL after the user performs certain gestures. The result is a UI spoofing condition where the visible address does not match the origin actually serving content. This class of flaw maps to [CWE-451] and is commonly abused in phishing chains targeting mobile users, where screen real estate is limited and users cannot easily inspect certificate details.

Root Cause

The root cause is improper handling of Omnibox rendering state during specific navigation and user interaction sequences. Chrome fails to enforce a consistent binding between the displayed URL and the document actually loaded in the active tab. When an attacker-controlled page triggers navigation transitions timed with user gestures, the Omnibox retains or displays an attacker-chosen string.

Attack Vector

Exploitation is network-based and requires user interaction. The attacker hosts a malicious HTML page and lures the target to visit it, typically through a phishing link or malvertising. Once loaded, the page uses scripted navigation, focus manipulation, or history APIs to induce the spoof. The user must complete specific gestures such as tapping, scrolling, or dismissing UI elements for the condition to trigger. No verified public proof-of-concept or exploit code is currently available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

No verified exploit code is available for this vulnerability. Refer to the Chromium Issue Report #452392032 for technical details as they become public after the standard Chromium disclosure window.

Detection Methods for CVE-2025-12728

Indicators of Compromise

Android Chrome clients running versions earlier than 142.0.7444.137 connecting to newly registered or low-reputation domains.
Web traffic containing HTML pages that programmatically invoke history.pushState, history.replaceState, or rapid window.open sequences immediately after user gestures.
Reports from users describing a mismatch between the domain in the Omnibox and the visible page content, such as login forms appearing under trusted brand URLs.

Detection Strategies

Inventory Chrome versions across managed Android fleets using mobile device management (MDM) telemetry and flag installations below 142.0.7444.137.
Correlate DNS and proxy logs with threat intelligence feeds to surface known phishing infrastructure serving crafted HTML payloads.
Inspect user-reported phishing samples in a sandbox and confirm whether they attempt to manipulate Omnibox state through scripted navigation.

Monitoring Recommendations

Monitor secure web gateway logs for repeated visits to domains hosting content-type text/html pages that trigger multiple navigation events within a short window.
Track user-submitted phishing reports and pivot on shared URL patterns, certificates, and hosting providers.
Enable browser telemetry through Chrome Enterprise reporting to surface version drift and unpatched endpoints.

How to Mitigate CVE-2025-12728

Immediate Actions Required

Update Google Chrome on Android to version 142.0.7444.137 or later through the Google Play Store.
Push the update to managed Android devices through your MDM solution and enforce minimum browser version policies.
Educate users to verify page authenticity by refreshing the tab, closing and reopening it, or inspecting site information through the padlock menu before entering credentials.

Patch Information

Google addressed the issue in the Chrome Stable Channel update announced in the Google Chrome Stable Update. Android users receive the fix in Chrome 142.0.7444.137 and later. Additional context is available in the Chromium Issue Report #452392032.

Workarounds

Restrict browsing on unpatched Android devices to trusted domains through enterprise URL allowlists until the update is deployed.
Deploy phishing-resistant authentication such as FIDO2 security keys or platform authenticators so that spoofed Omnibox URLs do not yield usable credentials.
Enable Google Safe Browsing Enhanced Protection to increase blocking of known phishing pages that could leverage this technique.

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for a patched device:
# versionName=142.0.7444.137