CVE-2025-13635: Google Chrome UI Spoofing Vulnerability

CVE-2025-13635 Overview

CVE-2025-13635 is a user interface (UI) spoofing vulnerability in the Downloads component of Google Chrome prior to version 143.0.7499.41. A crafted HTML page can manipulate download-related UI elements, allowing a local attacker to mislead users about the nature or origin of a downloaded file. The flaw is categorized under [CWE-290] (Authentication Bypass by Spoofing) and requires user interaction to succeed. Google classifies the Chromium security severity as Low, and the issue affects Chrome across Windows, macOS, and Linux desktop platforms.

Critical Impact
An attacker can present deceptive download prompts through a crafted web page, increasing the likelihood that users execute or trust malicious files.

Affected Products

Google Chrome prior to 143.0.7499.41 on Microsoft Windows
Google Chrome prior to 143.0.7499.41 on Apple macOS
Google Chrome prior to 143.0.7499.41 on Linux

Discovery Timeline

2025-12-02 - CVE-2025-13635 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-13635

Vulnerability Analysis

The vulnerability resides in the Downloads component of Google Chrome. The browser's handling of download-related UI elements can be influenced by content served from a crafted HTML page. This allows an attacker to alter what the user perceives about a download, such as the filename, source, or origin indicator. The result is a spoofed presentation that impairs the user's ability to make an informed trust decision. Because exploitation requires the user to visit attacker-controlled content and interact with the download flow, the vulnerability is a social engineering enabler rather than a direct code execution flaw.

Root Cause

The root cause is an inappropriate implementation in Chrome's Downloads UI logic. The rendering path does not adequately isolate or authenticate the origin metadata displayed to the user during a download event. This maps to [CWE-290], where a component fails to enforce a strong association between displayed identity information and the actual source of the action. Refer to the Chromium Issue Tracker #405727341 for the underlying implementation details.

Attack Vector

Exploitation requires a user to visit or interact with a crafted HTML page under attacker control. The attacker manipulates DOM elements, download attributes, or navigation patterns to trigger a misleading Downloads UI presentation. No elevated privileges or authentication are required on the target system, but the attack is local in scope and depends on user interaction with the download prompt. The vulnerability is not a remote code execution flaw and does not by itself grant the attacker execution on the endpoint.

No public proof-of-concept or exploit code has been released. The vulnerability is described in prose only in the vendor advisory. See the Google Chrome Stable Channel Update for the vendor's summary.

Detection Methods for CVE-2025-13635

Indicators of Compromise

Chrome browser instances running versions earlier than 143.0.7499.41 present on managed endpoints.
Downloaded files with mismatched extensions, unexpected origins, or filenames that do not correspond to the visited domain.
Browser history entries showing navigation to unfamiliar or newly registered domains immediately preceding a suspicious download.

Detection Strategies

Inventory Chrome versions across managed endpoints and flag any host running a build older than 143.0.7499.41.
Correlate browser download telemetry with process execution events to identify files launched shortly after download from untrusted domains.
Review web proxy and DNS logs for user navigation to suspicious pages that immediately trigger download events.

Monitoring Recommendations

Ingest endpoint file-creation and process-execution telemetry into a centralized data lake for correlation with browser activity.
Alert on execution of files written to standard browser download directories when the parent process is chrome.exe or equivalent.
Monitor user reports of unexpected or deceptive download prompts as a qualitative detection signal for UI spoofing attempts.

How to Mitigate CVE-2025-13635

Immediate Actions Required

Update Google Chrome to version 143.0.7499.41 or later on all Windows, macOS, and Linux endpoints.
Verify that Chrome auto-update mechanisms are enabled and functioning across the managed fleet.
Communicate with users to reinforce caution when interacting with unexpected download prompts, especially those originating from unfamiliar sites.

Patch Information

Google addressed the vulnerability in the Stable Channel update for Chrome 143.0.7499.41. The fix is available on the Windows, macOS, and Linux release channels. Full details are published in the Google Chrome Stable Channel Update for Desktop.

Workarounds

Enforce enterprise policy to block downloads from untrusted or uncategorized sites via web proxy or Chrome Enterprise policies.
Restrict execution of unsigned or unexpected binaries downloaded from the browser through application control policies.
Deploy user awareness guidance covering UI spoofing techniques and safe handling of browser download prompts until patching is complete.

bash

# Verify Chrome version on Linux endpoints
google-chrome --version

# Example Chrome Enterprise policy (JSON) to restrict downloads to safe origins
# Place in /etc/opt/chrome/policies/managed/ on Linux
{
  "URLBlocklist": ["*"],
  "URLAllowlist": ["https://*.corp.example.com"],
  "DownloadRestrictions": 3
}