CVE-2025-1917: Google Chrome XSS Vulnerability

CVE-2025-1917 Overview

CVE-2025-1917 is a user interface (UI) spoofing vulnerability in Google Chrome for Android. The flaw stems from an inappropriate implementation in the Browser UI component. It affects Chrome on Android versions prior to 134.0.6998.35. A remote attacker can trigger the issue by luring a user to a crafted HTML page. Successful exploitation lets the attacker manipulate browser UI elements to deceive users. Google Chromium rates the severity as Medium. The weakness is tracked as CWE-1021: Improper Restriction of Rendered UI Layers or Frames, commonly associated with clickjacking and address bar spoofing. User interaction is required for exploitation.

Critical Impact
Remote attackers can spoof browser UI elements on Android to trick users into trusting attacker-controlled content, enabling phishing and credential theft.

Affected Products

Google Chrome for Android versions prior to 134.0.6998.35
Google Android platform (Chrome browser component)
Downstream Chromium-based Android browsers using vulnerable engine versions

Discovery Timeline

2025-03-05 - CVE-2025-1917 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-1917

Vulnerability Analysis

The vulnerability lives in the Browser UI layer of Chrome on Android. Chrome's mobile UI renders address bars, permission prompts, and security indicators alongside web content. The inappropriate implementation lets a crafted HTML page influence or overlap these trusted UI elements. An attacker can present misleading origin information or fake browser chrome to a victim. This deception undermines the visual trust model users rely on for phishing detection. The vulnerability requires user interaction, such as visiting an attacker-controlled URL. It does not grant code execution or direct data access. Instead, it enables social engineering attacks with higher success rates. The issue is classified under CWE-1021.

Root Cause

The root cause is improper restriction of rendered UI layers in the Android Browser UI. Chrome fails to isolate untrusted web content from browser-controlled indicators under specific rendering conditions. This lets attacker-supplied HTML draw over or mimic native browser components. Reference details are tracked in the Chromium Issue Tracker Entry.

Attack Vector

The attack vector is network-based. An attacker hosts a crafted HTML page and lures the victim to open it in Chrome on Android. When the victim interacts with the page, malicious content can spoof the address bar or other UI signals. The attacker then presents a fake login prompt or misleading origin banner. Victims believing they are on a legitimate site may submit credentials or approve unsafe actions. No authentication or elevated privileges are needed on the attacker side. Full mitigation details are published in the Google Chrome Stable Channel Update.

No verified public proof-of-concept code is available for CVE-2025-1917. Technical specifics remain restricted in the Chromium issue tracker per Google's disclosure policy.

Detection Methods for CVE-2025-1917

Indicators of Compromise

Chrome for Android build strings reporting versions earlier than 134.0.6998.35 in enterprise inventory data
User reports of address bar inconsistencies, unexpected overlays, or duplicate URL displays on mobile devices
Phishing pages referencing mobile-specific viewport dimensions and Chrome Android user agents in web proxy logs

Detection Strategies

Inventory Chrome on Android versions through Mobile Device Management (MDM) telemetry and flag builds below 134.0.6998.35
Correlate suspicious HTML pages exhibiting fullscreen API abuse, custom overlays near viewport top, or fixed-position elements mimicking browser chrome
Monitor phishing intelligence feeds for landing pages targeting mobile Chrome users with credential harvesting flows

Monitoring Recommendations

Log Chrome version data from managed Android devices and alert on outdated installations
Track outbound connections from mobile fleets to newly registered domains that host crafted HTML content
Review user-reported phishing submissions where victims describe URL bar behavior that does not match the destination site

How to Mitigate CVE-2025-1917

Immediate Actions Required

Update Google Chrome on Android to version 134.0.6998.35 or later through the Google Play Store
Push a forced update policy via Mobile Device Management for managed Android fleets
Communicate the risk to end users and reinforce awareness of mobile phishing techniques that exploit UI spoofing

Patch Information

Google released the fix in Chrome for Android version 134.0.6998.35. Details are documented in the Google Chrome Stable Channel Update advisory. The underlying tracking record is available in the Chromium Issue Tracker Entry. Enterprises using managed Chrome deployments should confirm rollout completion through Chrome Browser Cloud Management or equivalent MDM reporting.

Workarounds

Restrict browsing to trusted domains through DNS filtering or secure web gateway policies until patching completes
Enable Google Safe Browsing Enhanced Protection on Android devices to increase warnings against known phishing pages
Train users to verify URLs by tapping the address bar rather than relying on visual chrome, reducing spoofing effectiveness

bash

# Verify installed Chrome version on Android via adb
adb shell dumpsys package com.android.chrome | grep versionName

# Expected output for patched builds:
# versionName=134.0.6998.35 (or later)