CVE-2025-12906: Google Chrome UI Spoofing Vulnerability

CVE-2025-12906 Overview

CVE-2025-12906 is a user interface (UI) spoofing vulnerability in the Permissions component of Google Chrome. The flaw stems from an inappropriate implementation that allows a remote attacker to deceive users through a crafted HTML page. Successful exploitation requires user interaction, such as visiting a malicious website. The issue affects Google Chrome versions prior to 140.0.7339.80 and is tracked under [CWE-693: Protection Mechanism Failure]. Google classified the Chromium security severity as Low, while the NVD assigned a CVSS 3.1 base score of 5.4.

Critical Impact
Attackers can spoof browser permission prompts or other UI elements to mislead users into granting sensitive permissions or trusting malicious content.

Affected Products

Google Chrome versions prior to 140.0.7339.80
Chromium-based browsers incorporating the vulnerable Permissions implementation
Desktop Chrome across Windows, macOS, and Linux stable channels

Discovery Timeline

2025-11-08 - CVE-2025-12906 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-12906

Vulnerability Analysis

The vulnerability resides in the Permissions subsystem of Google Chrome. Chrome uses this subsystem to request user consent for sensitive capabilities such as camera, microphone, geolocation, notifications, and clipboard access. An inappropriate implementation allows a crafted HTML page to manipulate how permission-related UI is rendered. This creates a discrepancy between what the user sees and what the browser is actually authorizing.

UI spoofing attacks of this class typically leverage timing, overlays, or origin confusion. A malicious page can present visual elements that mimic legitimate browser chrome or obscure the true origin requesting a permission. Users who trust the spoofed prompt may unintentionally grant access to a hostile site.

Root Cause

The root cause is a protection mechanism failure ([CWE-693]) in how Chrome's Permissions component enforces UI integrity. The implementation does not sufficiently isolate or validate rendering conditions when a permission-related surface is displayed. This gap allows page-controlled content to influence the appearance or context of the prompt.

Attack Vector

Exploitation occurs over the network. An attacker hosts a crafted HTML page and lures a victim into visiting it through phishing, malvertising, or a compromised site. User interaction is required, which limits automated exploitation but remains realistic in targeted campaigns. No authentication or elevated privileges are needed. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Announcement for vendor details.

Detection Methods for CVE-2025-12906

Indicators of Compromise

Chrome desktop clients reporting a version below 140.0.7339.80 in inventory or telemetry data
Browser navigation logs showing visits to unfamiliar domains immediately followed by permission grants for camera, microphone, geolocation, or notifications
User reports of permission prompts that appear misleading, misaligned, or attributed to unexpected origins

Detection Strategies

Query endpoint inventory for installed Chrome versions and flag any instance older than 140.0.7339.80
Correlate web proxy logs with browser permission changes to identify suspicious grant patterns tied to newly visited domains
Monitor Chrome enterprise reporting for permission policy overrides and unexpected site-level permission changes

Monitoring Recommendations

Enable Chrome Enterprise reporting to centralize version, extension, and permission telemetry
Alert on outbound connections to low-reputation domains that host HTML content served to end users
Track help-desk tickets referencing unexpected permission prompts or UI anomalies in the browser

How to Mitigate CVE-2025-12906

Immediate Actions Required

Update Google Chrome to version 140.0.7339.80 or later on all managed endpoints
Force-restart Chrome after deployment to ensure the patched binary is loaded into memory
Audit site-level permissions across the fleet and revoke grants issued to untrusted origins

Patch Information

Google addressed CVE-2025-12906 in the Chrome Stable channel update to 140.0.7339.80. Details are available in the Google Chrome Update Announcement. Chromium-based downstream browsers should apply the corresponding upstream fix referenced in the Chromium Issue Tracker Entry.

Workarounds

Deploy Chrome Enterprise policies to restrict sensitive permissions such as DefaultGeolocationSetting, DefaultNotificationsSetting, and media capture to allow-listed origins
Educate users to verify the origin displayed in permission prompts and to deny prompts on unfamiliar sites
Block known malicious and low-reputation domains at the web proxy or DNS layer to reduce exposure to crafted HTML pages

bash

# Configuration example: Chrome Enterprise policy to restrict permissions by default
# Windows registry path: HKLM\Software\Policies\Google\Chrome
DefaultGeolocationSetting = 2      # Block geolocation by default
DefaultNotificationsSetting = 2    # Block notifications by default
DefaultMediaStreamSetting = 2      # Block camera and microphone by default
DefaultClipboardSetting = 2        # Block clipboard access by default