CVE-2025-12729: Google Chrome XSS Vulnerability

CVE-2025-12729 Overview

CVE-2025-12729 is a user interface spoofing vulnerability in the Omnibox component of Google Chrome on Android. Versions prior to 142.0.7444.137 contain an inappropriate implementation that allows a remote attacker to manipulate what users see in the address bar. The attacker must convince a user to perform specific UI gestures on a crafted HTML page. Successful exploitation enables the attacker to misrepresent the origin of displayed content, which supports phishing and credential theft campaigns. Google classifies the issue with Chromium security severity Medium and assigned it to weakness class [CWE-451] (User Interface Misrepresentation of Critical Information).

Critical Impact
Attackers can spoof the Chrome for Android address bar to impersonate trusted origins, enabling convincing phishing pages that appear to load from legitimate domains.

Affected Products

Google Chrome on Android prior to 142.0.7444.137
Google Android devices running vulnerable Chrome builds
Chromium-derived Android browsers sharing the Omnibox implementation

Discovery Timeline

2025-11-10 - CVE-2025-12729 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12729

Vulnerability Analysis

The Omnibox is the combined address and search bar in Chrome. It renders the origin of the currently loaded document and serves as the primary trust indicator users rely on to verify site identity. This vulnerability stems from an inappropriate implementation in how the Android Omnibox handles rendering state during specific user interactions. A crafted HTML page can drive the browser into a state where the address bar shows content that does not correspond to the true origin of the rendered document.

Exploitation requires network access to serve the malicious page and user interaction in the form of specific UI gestures such as scrolling, tapping, or navigation actions. The attack complexity is high because the attacker must reliably chain the required gestures to trigger the spoof. Impact is limited to confidentiality and integrity of user-facing trust information. There is no direct memory corruption or code execution. However, a successful spoof undermines the origin indicator, which is the foundation of web security decisions users make about credentials, downloads, and permissions.

Root Cause

The root cause is improper synchronization between the Omnibox display state and the actual document origin during transitional UI events on Android. The Omnibox continues to display a previously trusted URL while a different, attacker-controlled document is rendered in the viewport. This maps to [CWE-451], where the user interface fails to communicate critical security-relevant information correctly.

Attack Vector

The attack is delivered remotely over the network through a crafted HTML page. The victim must visit the attacker-controlled page and perform one or more specific UI gestures. Once the spoof triggers, the attacker can present a fake login form or fraudulent content that appears to originate from a legitimate site indicated by the Omnibox. See the Chromium Issue Report for the technical tracking record.

No verified proof-of-concept code is publicly available. The vulnerability is described in prose in the vendor advisory rather than through published exploit code.

Detection Methods for CVE-2025-12729

Indicators of Compromise

User reports of Chrome for Android displaying a trusted domain in the address bar while the page content or login form appears inconsistent with that domain
Credential submissions from mobile users to phishing infrastructure that references legitimate brand domains in referrer or campaign telemetry
Traffic to newly registered domains hosting HTML content that specifically targets Chrome Android user agents with gesture-driven scripts

Detection Strategies

Inventory Chrome for Android versions across managed mobile devices and flag any build older than 142.0.7444.137
Monitor mobile endpoint telemetry for browser process versions using enterprise mobility management (EMM) or unified endpoint management (UEM) reporting
Correlate phishing report submissions from users on Android devices with the browser build in use at the time of the incident

Monitoring Recommendations

Ingest Chrome update posture data into your SIEM or data lake and alert on devices that remain below the patched version after a defined grace period
Track outbound DNS and HTTP requests from mobile devices to domains flagged by threat intelligence for credential phishing
Review user-reported phishing incidents for patterns consistent with Omnibox spoofing, particularly cases where users insist the URL was correct

How to Mitigate CVE-2025-12729

Immediate Actions Required

Update Google Chrome on Android to version 142.0.7444.137 or later through the Google Play Store
Push the update to managed Android fleets using your EMM or UEM policy for managed Google Play
Communicate to users that they should verify domain names carefully and treat unexpected credential prompts as suspicious until devices are patched

Patch Information

Google released the fix in Chrome for Android version 142.0.7444.137. Details are documented in the Google Chrome Update Blog. The corresponding Chromium tracking entry is available in the Chromium Issue Report. Applying the vendor update is the only complete remediation.

Workarounds

Enforce a minimum Chrome version policy through managed Google Play configuration to block use of vulnerable builds
Direct high-risk users to authenticate to sensitive services through native mobile applications rather than through the browser until patching is complete
Deploy phishing-resistant authentication such as FIDO2 security keys or platform authenticators, which bind credentials to the true origin and defeat Omnibox spoofing attempts

bash

# Verify installed Chrome version on an Android device via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output should show versionName=142.0.7444.137 or higher