CVE-2025-13637 Overview
CVE-2025-13637 is a download protection bypass in Google Chrome versions prior to 143.0.7499.41. The flaw stems from an inappropriate implementation in the Downloads component. A remote attacker who convinces a user to perform specific UI gestures can bypass download protections through a crafted HTML page.
The vulnerability is classified under [CWE-449] (The UI Performs the Wrong Action). Google rated the Chromium security severity as Low. The issue affects Chrome across Windows, macOS, and Linux platforms.
Critical Impact
Attackers can bypass Chrome download protections and deliver files that would normally trigger safety warnings, increasing the risk of malware delivery through drive-by-download campaigns.
Affected Products
- Google Chrome versions prior to 143.0.7499.41 on Microsoft Windows
- Google Chrome versions prior to 143.0.7499.41 on Apple macOS
- Google Chrome versions prior to 143.0.7499.41 on Linux
Discovery Timeline
- 2025-12-02 - CVE-2025-13637 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-13637
Vulnerability Analysis
The vulnerability resides in the Downloads component of Google Chrome. Chrome enforces download protections that warn users or block files deemed potentially dangerous based on file type, origin, and reputation checks against Safe Browsing. The inappropriate implementation allows these checks to be bypassed when a user is guided through specific UI interactions on an attacker-controlled page.
Because the attack requires user interaction, exploitation depends on social engineering. The confidentiality impact is none, the integrity impact is low, and the availability impact is none. The attack executes over the network with low complexity and no privileges required.
The EPSS probability for this CVE is 0.181%, reflecting a low likelihood of observed exploitation activity. No public proof-of-concept code, exploit database entry, or CISA KEV listing exists at publication.
Root Cause
The root cause is a UI-layer logic flaw categorized under [CWE-449]. Chrome's download workflow performs the wrong action when triggered by a specific sequence of user gestures orchestrated by a crafted HTML page. Safeguards intended to prompt the user or block the download do not activate along this code path.
Attack Vector
An attacker hosts a crafted HTML page and lures the victim to visit it. The page uses scripted elements and page structure to prompt the victim into performing gestures such as clicks or key presses. Once the gesture sequence completes, Chrome initiates a download without applying the expected protection warnings, enabling delivery of a file the browser would otherwise flag.
Refer to the Chromium Issue Tracker Entry for the technical bug record and the Google Chrome Desktop Update for the vendor advisory.
Detection Methods for CVE-2025-13637
Indicators of Compromise
- Chrome browser processes writing executable or script files to user download directories without a corresponding Safe Browsing prompt event in browser telemetry
- Outbound HTTP or HTTPS connections to newly registered or low-reputation domains immediately preceding unexpected file writes by chrome.exe, Chrome on macOS, or chrome on Linux
- Web pages containing scripted click handlers that call download-initiating APIs after synthetic gesture sequences
Detection Strategies
- Inventory installed Chrome versions across the fleet and flag any endpoint running a version below 143.0.7499.41
- Monitor endpoint file creation events where the parent process is Chrome and the resulting file has a high-risk extension such as .exe, .msi, .dll, .hta, .js, or .lnk
- Correlate browser navigation events with subsequent download and process execution to identify drive-by-download sequences that skipped user prompts
Monitoring Recommendations
- Ingest Chrome browser telemetry and Safe Browsing event logs into the SIEM to establish a baseline for prompted versus silent downloads
- Alert on execution of files downloaded by Chrome within short time windows after page navigation, especially from external domains
- Track patch compliance for browser versions as part of standard vulnerability management reporting
How to Mitigate CVE-2025-13637
Immediate Actions Required
- Update Google Chrome to version 143.0.7499.41 or later on all Windows, macOS, and Linux endpoints
- Force browser restart after the update to ensure the patched binary is loaded into memory
- Verify enterprise policy enforcement so that Chrome auto-update is not disabled on managed endpoints
Patch Information
Google addressed CVE-2025-13637 in the Chrome Stable channel release documented in the Google Chrome Desktop Update. Administrators should deploy Chrome 143.0.7499.41 or newer through their standard software distribution or MDM tooling. Chromium-based browsers that consume upstream fixes should also be updated once vendors ship the corresponding release.
Workarounds
- Enable Chrome Enhanced Safe Browsing through enterprise policy to increase scrutiny of downloads and browsing activity
- Restrict file execution from user download directories using application control or AppLocker-equivalent policies
- Deliver user awareness guidance warning against following unexpected click sequences prompted by unfamiliar websites
# Verify installed Chrome version on Linux
google-chrome --version
# Verify installed Chrome version on macOS
/Applications/Google\ Chrome.app/Contents/MacOS/Google\ Chrome --version
# Verify installed Chrome version on Windows (PowerShell)
(Get-Item "C:\Program Files\Google\Chrome\Application\chrome.exe").VersionInfo.ProductVersion
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
