CVE-2025-1922 Overview
CVE-2025-1922 is a user interface (UI) spoofing vulnerability in Google Chrome on Android versions prior to 134.0.6998.35. The flaw resides in the Selection component and stems from an inappropriate implementation that a remote attacker can abuse through a crafted HTML page. Successful exploitation requires the target user to perform specific UI gestures, after which the attacker can misrepresent security-relevant interface elements. Google classified the underlying Chromium severity as Low, and the issue maps to [CWE-451: User Interface (UI) Misrepresentation of Critical Information]. The vulnerability affects integrity only and does not compromise confidentiality or availability directly.
Critical Impact
Attackers can spoof browser UI elements on Android to mislead users into trusting attacker-controlled content, enabling phishing and social engineering attacks against Chrome mobile users.
Affected Products
- Google Chrome on Android versions prior to 134.0.6998.35
- Google Android platform hosting vulnerable Chrome builds
- Chromium-based mobile browsers sharing the affected Selection implementation
Discovery Timeline
- 2025-03-05 - CVE-2025-1922 published to the National Vulnerability Database (NVD)
- 2026-06-17 - Last updated in the NVD database
Technical Details for CVE-2025-1922
Vulnerability Analysis
The vulnerability originates in Chrome's Selection subsystem on Android, which manages text selection handles, context menus, and related overlays. An inappropriate implementation permits attacker-controlled HTML to influence how selection-related UI is rendered relative to trusted browser chrome. When a user performs specific gestures such as long-press or drag on a crafted page, the browser can display UI elements in a manner that misleads the user.
The attack requires user interaction and network delivery through any web resource that renders HTML content. Because Chrome on Android occupies most of the screen, spoofed overlays can obscure origin indicators, address bar content, or permission prompts. The classification under CWE-451 confirms that the root risk is misrepresentation of critical information rather than memory corruption or code execution.
The impact is limited to integrity loss through user deception. Confidential data such as credentials may still be exposed downstream if a user is tricked into submitting information to a spoofed interface.
Root Cause
The root cause is improper handling of the Selection UI rendering pipeline on Android. Chrome fails to correctly isolate attacker-drawn page content from trusted browser UI when specific gesture sequences trigger selection overlays. This allows crafted HTML to influence positioning or appearance of security-relevant indicators.
Attack Vector
An attacker hosts a crafted HTML page and lures the target to visit it using Chrome on Android. The page induces the user to perform specific gestures, such as tapping, long-pressing, or dragging over attacker-controlled elements. The resulting Selection UI is rendered in a way that spoofs legitimate browser UI, enabling phishing or trust-decision manipulation.
Exploitation of the vulnerability is described in prose only, as no verified public proof-of-concept code is available. Refer to the Chromium Issue Tracking #384033062 entry for additional technical context once access restrictions are lifted.
Detection Methods for CVE-2025-1922
Indicators of Compromise
- Chrome for Android clients reporting a version string earlier than 134.0.6998.35 in HTTP User-Agent telemetry.
- User reports of unexpected selection handles, tooltips, or overlays appearing over the address bar or permission dialogs.
- Mobile phishing landing pages that instruct users to long-press or drag on specific page elements as a prerequisite to "verify" or "continue".
Detection Strategies
- Inventory managed Android devices and identify Chrome installations below 134.0.6998.35 through mobile device management (MDM) reporting.
- Inspect web proxy logs for outbound requests to newly registered domains serving HTML with unusual gesture-driven interaction flows.
- Correlate user-reported phishing incidents on mobile with browser version data to identify targeted campaigns exploiting UI spoofing.
Monitoring Recommendations
- Enable browser version telemetry ingestion from MDM and endpoint tools into your security information and event management (SIEM) platform.
- Monitor for credential submission events from mobile browsers to domains not on approved allowlists.
- Track user-reported suspicious mobile browsing events through a dedicated phishing reporting workflow.
How to Mitigate CVE-2025-1922
Immediate Actions Required
- Update Google Chrome on Android to version 134.0.6998.35 or later through the Google Play Store.
- Enforce automatic Chrome updates on managed Android devices via MDM configuration policies.
- Deliver user awareness communications warning against unfamiliar mobile pages that request specific touch gestures.
Patch Information
Google addressed CVE-2025-1922 in the Chrome Stable channel update announced in the Google Chrome Desktop Update advisory, with the fix shipping in Chrome for Android 134.0.6998.35. Deploy the patched build across all managed mobile endpoints. Additional context is tracked in Chromium Issue Tracking #384033062.
Workarounds
- Restrict browsing on high-risk mobile devices to trusted domains using MDM web content filtering until Chrome is updated.
- Disable or replace Chrome as the default mobile browser on managed devices where patching is delayed.
- Educate users to verify the address bar and origin indicators before entering credentials on mobile browsers.
# Configuration example: verify Chrome version on managed Android via ADB
adb shell dumpsys package com.android.chrome | grep versionName
# Expected output should report 134.0.6998.35 or higher
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
