CVE-2025-3073 — User Interface (UI) Misrepresentation of Critical Information in Google Chrome

CWE-451 — User Interface (UI) Misrepresentation of Critical Information9 documents9 sources

Severity

5.4MEDIUMNVD

EPSS

0.2%

top 59.92%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Google Chrome Chromium Paloalto Prisma Browser

Timeline

PublishedApr 2

Latest updateMay 14

Description

Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:NExploitability: 2.8 | Impact: 2.5

Affected Packages4 packages

▶CVEListV5google/chrome135.0.7049.52 — 135.0.7049.52

▶NVDgoogle/chrome< 135.0.7049.52

▶Debianchromium/chromium< 135.0.7049.52-1~deb12u1+2

▶Palo Altopaloalto/prisma_browser

🔴Vulnerability Details

CVEList

CVE-2025-3073: Inappropriate implementation in Autofill in Google Chrome prior to 135↗2025-04-02

▶

OSV

CVE-2025-3073: Inappropriate implementation in Autofill in Google Chrome prior to 135↗2025-04-02

▶

GHSA

GHSA-7768-6597-437r: Inappropriate implementation in Autofill in Google Chrome prior to 135↗2025-04-02

▶

📋Vendor Advisories

Palo Alto

PAN-SA-2025-0009 Chromium: Monthly Vulnerability Update (May 2025)↗2025-05-14

▶

Chrome

Stable Channel Update for ChromeOS / ChromeOS Flex: CVE-2025-3073↗2025-04-17

▶

Microsoft

Chromium: CVE-2025-3073 Inappropriate implementation in Autofill↗2025-04-08

▶

Debian

CVE-2025-3073: chromium - Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52...↗2025

▶

🕵️Threat Intelligence

Bleepingcomputer

Microsoft April 2025 Patch Tuesday fixes exploited zero-day, 134 flaws↗2025-04-08

▶