CVE-2025-13636 Overview
CVE-2025-13636 is a user interface (UI) spoofing vulnerability affecting Google Chrome versions prior to 143.0.7499.41. The flaw resides in the browser's Split View feature and stems from an inappropriate implementation that allows attackers to misrepresent origin information through crafted domain names. A remote attacker who convinces a user to perform specific UI gestures can exploit this weakness to spoof interface elements. The issue is classified under [CWE-290: Authentication Bypass by Spoofing]. Google's Chromium security team rated the underlying issue as Low severity, while NVD scoring places it in the medium range due to network-based exploitation potential.
Critical Impact
An attacker can present misleading UI content to a victim, enabling phishing scenarios where users believe they are interacting with a trusted domain within a Chrome Split View session.
Affected Products
- Google Chrome prior to 143.0.7499.41 on Windows
- Google Chrome prior to 143.0.7499.41 on macOS
- Google Chrome prior to 143.0.7499.41 on Linux
Discovery Timeline
- 2025-12-02 - CVE-2025-13636 published to NVD
- 2025-12-02 - Google releases stable channel update addressing the flaw
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13636
Vulnerability Analysis
The vulnerability affects Chrome's Split View functionality, a feature that allows users to view two web pages side by side within a single browser window. The inappropriate implementation permits a remote attacker to leverage crafted domain names to spoof UI elements shown to the user. Because Split View displays multiple origins simultaneously, users rely on visual cues to distinguish trusted content from untrusted content. When those cues can be manipulated, the trust boundary between the two panes weakens.
Exploitation requires user interaction. The attacker must convince the target to perform specific UI gestures inside the browser, such as navigating or dragging elements between panes. The result is limited to visual deception rather than direct code execution or data disclosure, so integrity and confidentiality are unaffected at the technical level. However, the spoofed interface can drive users toward credential submission or malware installation on attacker-controlled content.
Root Cause
The root cause is improper handling of specially crafted domain names within the Split View rendering logic, mapped to [CWE-290]. Chrome's UI trust indicators fail to correctly normalize or display the origin, allowing the attacker's domain to appear as though it originated from a legitimate source.
Attack Vector
The attack vector is network-based. An attacker hosts a malicious page containing the crafted domain reference and lures a victim into opening it inside Split View. The victim must then perform the required UI gesture for the spoof to render. No authentication or elevated privileges are required on the target system. See the Chromium Issue Tracker Entry for additional technical context.
Detection Methods for CVE-2025-13636
Indicators of Compromise
- Chrome browser processes running versions earlier than 143.0.7499.41 across managed endpoints
- Web traffic to domains containing unusual Unicode, punycode, or lookalike character sequences designed to mimic trusted brands
- User reports of unexpected Split View panes or discrepancies between the address bar and displayed content
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any instance below 143.0.7499.41
- Monitor DNS and proxy logs for newly registered domains resembling internal or high-value external brands
- Correlate user-reported phishing incidents with recent Split View or multi-pane browser activity
Monitoring Recommendations
- Enable browser telemetry through Chrome Enterprise reporting to track version compliance
- Alert on outbound HTTPS connections to domains flagged by threat intelligence feeds as spoofing infrastructure
- Review email and messaging gateway logs for links that direct users to open content in secondary browser panes
How to Mitigate CVE-2025-13636
Immediate Actions Required
- Update Google Chrome to version 143.0.7499.41 or later on all Windows, macOS, and Linux endpoints
- Force a browser restart through endpoint management tooling to ensure the patched binaries are loaded
- Communicate phishing awareness reminders to users, emphasizing verification of URLs before interacting with Split View content
Patch Information
Google addressed the vulnerability in the Chrome stable channel update released on December 2, 2025. Administrators should deploy version 143.0.7499.41 or newer. Details are available in the Chrome Desktop Update Blog.
Workarounds
- Disable or discourage use of the Split View feature until all endpoints receive the patch
- Enforce Chrome auto-update policies via Group Policy on Windows or configuration profiles on macOS
- Deploy URL filtering rules that block navigation to known lookalike or homograph domains
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
