CVE-2025-14373: Google Chrome XSS Vulnerability

CVE-2025-14373 Overview

CVE-2025-14373 is a domain spoofing vulnerability in the Toolbar component of Google Chrome on Android. The flaw affects Chrome versions prior to 143.0.7499.110 and stems from an inappropriate implementation classified under CWE-1021 (Improper Restriction of Rendered UI Layers or Frames). A remote attacker can exploit the issue by serving a crafted HTML page that manipulates the browser toolbar to misrepresent the origin of displayed content. Google rated the Chromium security severity as Medium. Successful exploitation requires user interaction, such as visiting a malicious page. No public exploit code or in-the-wild exploitation has been reported, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Critical Impact
Attackers can spoof the displayed domain in the Chrome for Android toolbar, enabling convincing phishing attacks against mobile users who rely on the address bar to verify site identity.

Affected Products

Google Chrome for Android prior to 143.0.7499.110
Chrome installations on Microsoft Windows, Apple macOS, and Linux hosts referenced in CPE data
Downstream Chromium-based mobile browsers that inherit the affected Toolbar code

Discovery Timeline

2025-12-12 - CVE-2025-14373 published to the National Vulnerability Database
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-14373

Vulnerability Analysis

The vulnerability resides in the Toolbar UI implementation of Google Chrome on Android. The Toolbar is responsible for rendering the address bar and communicating the origin of the currently loaded page to the user. An inappropriate implementation in this component permits a crafted HTML page to influence what is displayed in the toolbar. The result is domain spoofing, where the URL or origin indicator does not match the site actually rendering content.

Because the mobile toolbar is one of the primary trust indicators available to users on constrained screens, misrepresentation of the origin undermines phishing defenses. The confidentiality impact is limited to information users may disclose after being misled about the site they are visiting. Integrity and availability are not directly affected. Exploitation requires the victim to interact with attacker-controlled content, typically by navigating to a malicious link.

Root Cause

The root cause is an inappropriate implementation within the Android Toolbar code path that fails to correctly restrict how page content can influence the rendered origin indicator. This aligns with CWE-1021, where UI layers are not adequately isolated from untrusted input. Details of the specific code path are tracked in the Chromium Issue Tracker Entry.

Attack Vector

An attacker hosts a crafted HTML page and lures a mobile Chrome user to visit it through phishing links, malvertising, or compromised sites. When the victim loads the page, the Toolbar renders a misleading origin, allowing the attacker to impersonate a trusted domain. Credential harvesting, malware distribution masquerading as legitimate downloads, and OAuth flow abuse are all plausible follow-on outcomes. See the Google Chrome Desktop Update advisory for the vendor statement.

Detection Methods for CVE-2025-14373

Indicators of Compromise

Mobile users reporting mismatches between a page's content and the domain displayed in the Chrome address bar
Traffic from managed Android devices to newly registered domains hosting login pages that mimic corporate services
Chrome for Android build strings below 143.0.7499.110 reported by mobile device management (MDM) inventory

Detection Strategies

Inspect mobile browsing telemetry for user visits to typosquatted or lookalike domains that could leverage toolbar spoofing for phishing
Correlate credential submission events against the actual destination domain to identify origin mismatch
Monitor endpoint and mobile threat defense logs for Chrome version drift across the fleet

Monitoring Recommendations

Track Chrome for Android version compliance through MDM or unified endpoint management dashboards
Enable phishing URL detection at the network egress and mail gateway to catch delivery of crafted HTML pages
Alert on repeated user reports of suspected phishing that originated from mobile browser sessions

How to Mitigate CVE-2025-14373

Immediate Actions Required

Update Google Chrome on Android to version 143.0.7499.110 or later through the Google Play Store
Enforce a minimum Chrome version policy on managed Android devices via MDM configuration
Communicate the risk of toolbar spoofing to users and reinforce phishing awareness for mobile browsing

Patch Information

Google released the fix in Chrome 143.0.7499.110 for Android. Refer to the Google Chrome Desktop Update release note and the Chromium Issue Tracker Entry for details. Deploy the update through the Google Play Store or enterprise app distribution channels.

Workarounds

Restrict browsing on unmanaged or outdated Chrome for Android builds until the update is applied
Route mobile web traffic through a secure web gateway that blocks known phishing infrastructure
Encourage users to verify sensitive site identity through bookmarks or app-based authentication rather than the toolbar alone

bash

# Verify installed Chrome version on an Android device via ADB
adb shell dumpsys package com.android.chrome | grep versionName