CVE-2025-25300: smartbanner.js XSS Vulnerability

CVE-2025-25300 Overview

CVE-2025-25300 affects smartbanner.js, a customizable smart app banner library for iOS and Android web pages. Versions prior to 1.14.1 render the View link without the rel="noopener" attribute. When a user clicks the link and navigates to a third-party page, the destination retains access to window.opener, allowing it to manipulate the originating page through redirection or script injection. The issue is categorized under [CWE-79] and was fixed in version 1.14.1.

Critical Impact
A malicious third-party landing page can hijack the referring window via window.opener, redirecting users or injecting content on the original site hosting the smart banner.

Affected Products

smartbanner.js versions prior to 1.14.1
Web applications embedding smartbanner.js with a View link pointing to third-party destinations
Non-Safari browsers where rel="noopener" is not automatically applied to target="_blank" links

Discovery Timeline

2025-02-18 - CVE-2025-25300 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2025-25300

Vulnerability Analysis

The smartbanner.js library renders a View button as an anchor element with target="_blank". In HTML, opening a link in a new browsing context without rel="noopener" grants the destination page a reference to the originating window through window.opener. A third-party page can then execute window.opener.location = 'https://attacker.example' to redirect the original tab to a phishing site. This tab-nabbing pattern is classified as a cross-site scripting adjacent flaw under [CWE-79] because attacker-controlled script running in the third-party context can influence the original document.

The scope of impact depends on where the View link points. When the destination is the Apple App Store or Google Play Store, exploitation risk is limited to app store infrastructure. When the destination is an arbitrary third-party page, any script on that page can abuse the exposed window.opener reference.

Root Cause

The root cause is a missing rel="noopener" attribute on the smart banner's View anchor element. Without this attribute, browsers preserve the window.opener reference across the new browsing context. Safari 12.1 and later implicitly apply noopener to target="_blank" links, which narrows exposure on iOS but does not protect Android or desktop browsers.

Attack Vector

Exploitation requires user interaction: a user must click the smart banner's View link and be routed to an attacker-controlled or attacker-influenced third-party destination. Once loaded, the third-party page uses window.opener to manipulate the original tab.

javascript

// Patch from smartbanner.js commit fce8c31 - src/smartbanner.js
-      <a href="${this.buttonUrl}" target="_blank" class="smartbanner__button"><span class="smartbanner__button__label">${this.options.button}</span></a>
+      <a href="${this.buttonUrl}" target="_blank" class="smartbanner__button" rel="noopener"><span class="smartbanner__button__label">${this.options.button}</span></a>

Source: GitHub Commit fce8c31. The patch adds rel="noopener" to the rendered anchor, instructing browsers to sever the window.opener reference when the new tab loads.

Detection Methods for CVE-2025-25300

Indicators of Compromise

Unexpected navigation of the parent tab shortly after a user clicks a smart banner View link
Client-side error reports or user complaints describing redirection to unfamiliar pages after leaving the site
Anchor tags rendered by smartbanner.js in DOM inspection lacking the rel="noopener" attribute

Detection Strategies

Audit deployed front-end bundles for smartbanner.js versions earlier than 1.14.1 using software composition analysis tools
Scan production HTML for target="_blank" anchors that lack rel="noopener" or rel="noreferrer"
Review the configured buttonUrl values to confirm they resolve to trusted app store domains rather than arbitrary third-party hosts

Monitoring Recommendations

Enable a Content Security Policy that restricts frame-ancestors and reports violations to catch redirection abuse
Monitor referrer analytics for anomalous outbound flows from pages hosting the smart banner
Track dependency manifests (package.json, package-lock.json) in CI to alert on outdated smartbanner versions

How to Mitigate CVE-2025-25300

Immediate Actions Required

Upgrade smartbanner.js to version 1.14.1 or later across all production and staging deployments
Invalidate cached JavaScript bundles and CDN copies of the vulnerable library after upgrading
Verify that the rendered View anchor now includes rel="noopener" in browser developer tools

Patch Information

Version 1.14.1 of smartbanner.js contains the fix, applied in commit fce8c31dfe04033d9d005a89694d3e7a60784f89. Details are published in GitHub Security Advisory GHSA-9mrq-cjgh-32g2.

Workarounds

Configure the View link to point only to the Apple App Store or Google Play Store, where destination security is managed by the respective platform teams
Limit smartbanner.js deployment to iOS user agents, since Safari 12.1 and later automatically apply rel="noopener" to target="_blank" links
Manually patch the rendered anchor to include rel="noopener" if immediate upgrade is not feasible

bash

# Upgrade smartbanner.js to the patched version
npm install smartbanner@^1.14.1

# Verify installed version
npm ls smartbanner