CVE-2025-11210mediumCWE-1300

CVE-2025-11210: medium-severity vulnerability in Google Chrome

Published · Updated

Follow this CVE+ Monitor Chrome+ Monitor chromium

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.4epss 0.2%
In short

A flaw in Google Chrome's Tab feature allows attackers to trick users through visual deception by manipulating browser UI elements when users interact with the page in specific ways. This could fool users into clicking on fake buttons or believing they're on a different website.

Technical detail

CWE-1300 side-channel information leakage in Chrome's Tab component (prior to 141.0.7390.54) permits UI spoofing attacks via crafted HTML pages when users perform specific gestures. The vulnerability requires user interaction and convincing social engineering, but enables attackers to deceive users about the true origin or content of displayed UI elements.

Summary generated and translated by AI from the official description.
Side-channel information leakage in Tab in Google Chrome prior to 141.0.7390.54 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
Affected products
Google · Chrome
Related CVEs — Google Chrome

In the same product, most dangerous first.

CVE-2023-4863HIGHCVE-2023-4863EPSS 100.0%KEVCVE-2018-17463HIGHCVE-2018-17463EPSS 84.6%KEVCVE-2021-21224HIGHCVE-2021-21224EPSS 84.2%KEVCVE-2020-6418HIGHCVE-2020-6418EPSS 78.8%KEVCVE-2022-2294HIGHCVE-2022-2294EPSS 70.8%KEVCVE-2021-21220HIGHCVE-2021-21220EPSS 70.4%KEV