CVE-2025-3073: Google Chrome XSS Vulnerability

CVE-2025-3073 Overview

CVE-2025-3073 is a user interface (UI) spoofing vulnerability in the Autofill component of Google Chrome. The flaw affects Chrome versions prior to 135.0.7049.52 and stems from an inappropriate implementation in how Autofill renders interface elements. A remote attacker can exploit this issue by hosting a crafted HTML page and convincing a user to perform specific UI gestures. The vulnerability is categorized under [CWE-451] (User Interface Misrepresentation of Critical Information). Google rated the underlying Chromium security severity as Low, while the National Vulnerability Database assigns it a medium rating.

Critical Impact
Attackers can spoof Chrome's Autofill user interface to mislead users into disclosing personal data or performing unintended actions on attacker-controlled web pages.

Affected Products

Google Chrome versions prior to 135.0.7049.52
Chromium-based browsers incorporating the vulnerable Autofill implementation
Desktop builds across supported platforms (Windows, macOS, Linux)

Discovery Timeline

2025-04-02 - CVE-2025-3073 published to NVD
2025-04-21 - Last updated in NVD database

Technical Details for CVE-2025-3073

Vulnerability Analysis

The vulnerability resides in the Autofill subsystem of Google Chrome. Autofill suggests stored values such as addresses, payment data, or login fields when users interact with form elements. The implementation flaw allows a crafted HTML page to manipulate the presentation of Autofill prompts. An attacker who induces specific user interface gestures can cause Autofill to render in a misleading context. This leads to UI spoofing, where the displayed information does not accurately represent the underlying security state of the page.

User interaction is required for exploitation. The attack vector is network-based and requires no authentication. Confidentiality and integrity impacts are limited, while availability is not affected.

Root Cause

The root cause is improper validation of the rendering context for Autofill suggestions. Chrome's Autofill component does not sufficiently constrain when and how its UI surfaces appear in relation to attacker-controlled DOM elements. This permits crafted pages to overlay, reposition, or otherwise misrepresent Autofill prompts in ways that confuse users about the origin or purpose of the interaction.

Attack Vector

Exploitation requires a remote attacker to lure a victim to a malicious HTML page. The page is constructed to elicit specific UI gestures such as clicks, focus events, or form interactions. When the user performs these gestures, the spoofed Autofill UI is displayed. The user may then disclose information or trigger autofill actions believing they are interacting with a legitimate prompt.

No verified proof-of-concept code is publicly available. The Chromium issue tracker entry for this vulnerability remains restricted at the time of publication. See the Chromium Issue Tracker Entry and the Google Chrome Releases Update for vendor details.

Detection Methods for CVE-2025-3073

Indicators of Compromise

Browser telemetry showing Chrome versions earlier than 135.0.7049.52 in active use across managed endpoints
Web proxy logs recording user visits to untrusted pages followed by submission of form data containing autofill-managed fields
Phishing reports referencing pages that mimic banking, e-commerce, or identity workflows and request autofill interaction

Detection Strategies

Inventory installed Chrome versions across the fleet and flag any build prior to 135.0.7049.52 as exposed
Monitor URL reputation feeds and DNS resolution logs for navigations to newly registered or low-reputation domains that solicit autofill data
Correlate user-reported phishing incidents with browser version data to identify users on vulnerable builds

Monitoring Recommendations

Enable browser management telemetry through Chrome Browser Cloud Management or equivalent enterprise tooling
Forward browser update status and policy compliance events into the SIEM for continuous version drift detection
Alert on credential or PII submission events that follow navigation to uncategorized external domains

How to Mitigate CVE-2025-3073

Immediate Actions Required

Update Google Chrome to version 135.0.7049.52 or later on all managed endpoints
Force a browser relaunch through enterprise policy to ensure the patched binary is loaded into memory
Audit Chromium-based browsers and embedded WebView components for derivative exposure and update accordingly

Patch Information

Google addressed CVE-2025-3073 in the Stable Channel update released for Chrome 135.0.7049.52 on Windows, macOS, and Linux. Refer to the Google Chrome Releases announcement for the complete advisory and version mapping. Administrators using Chrome Browser Cloud Management can enforce the minimum version through policy.

Workarounds

Disable Autofill for addresses and payment methods via the AutofillAddressEnabled and AutofillCreditCardEnabled enterprise policies until patching is complete
Restrict end-user navigation to untrusted sites through web filtering or DNS-based controls
Train users to verify the origin of any prompt requesting personal or payment information before interacting

bash

# Configuration example: enforce minimum Chrome version and disable Autofill via policy on Linux
# /etc/opt/chrome/policies/managed/chrome_cve_2025_3073.json
{
  "AutofillAddressEnabled": false,
  "AutofillCreditCardEnabled": false,
  "BrowserSwitcherEnabled": false,
  "RelaunchNotification": 2,
  "RelaunchNotificationPeriod": 86400000
}