CVE-2025-3072 — User Interface (UI) Misrepresentation of Critical Information in Google Chrome

CWE-451 — User Interface (UI) Misrepresentation of Critical Information10 documents9 sources

Severity

5.4MEDIUMNVD

EPSS

0.2%

top 59.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Linux Kernel +1 more

Timeline

PublishedApr 2

Latest updateNov 12

Description

Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages5 packages

▶CVEListV5google/chrome135.0.7049.52 — 135.0.7049.52

▶NVDgoogle/chrome< 135.0.7049.52

▶Debianchromium/chromium< 135.0.7049.52-1~deb12u1+2

▶Linuxlinux/linux_kernel3.19.0 — 6.6.112+2

▶Palo Altopaloalto/prisma_browser

🔴Vulnerability Details

OSV

f2fs: fix to truncate first page in error path of f2fs_truncate()↗2025-11-12

▶

OSV

CVE-2025-3072: Inappropriate implementation in Custom Tabs in Google Chrome prior to 135↗2025-04-02

▶

CVEList

CVE-2025-3072: Inappropriate implementation in Custom Tabs in Google Chrome prior to 135↗2025-04-02

▶

GHSA

GHSA-wghf-qmx9-35pp: Inappropriate implementation in Custom Tabs in Google Chrome prior to 135↗2025-04-02

▶

📋Vendor Advisories

Red Hat

kernel: f2fs: fix to truncate first page in error path of f2fs_truncate()↗2025-11-12

▶

Palo Alto

PAN-SA-2025-0009 Chromium: Monthly Vulnerability Update (May 2025)↗2025-05-14

▶

Microsoft

Chromium: CVE-2025-3072 Inappropriate implementation in Custom Tabs↗2025-04-08

▶

Debian

CVE-2025-3072: chromium - Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049...↗2025

▶

🕵️Threat Intelligence

Bleepingcomputer

Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws↗2025-04-08

▶