CVE-2025-12430CWE-290

CVE-2025-12430

High · published November 11, 2025

CVSS v3.1
7.5
EPSS
0%
Percentile
24.0
In the wild
Unconfirmed
What it is

⚡ A crafty crafted HTML page is all it takes to pull off UI spoofing in Google Chrome! This vulnerability (CVE-2025-12430) is like a magician misdirecting your attention while they steal your watch. 🔍✨ Think of it like a restaurant menu that looks perfect, but the waiter is sneaking in a side dish you didn’t order. Users might be tricked into interacting with fake buttons or links that appear legitimate, leading to confusion and potentially harmful actions. An attacker can manipulate the user interface to display deceptive information, making it seem like the browser is working as expected. This could lead to users accidentally revealing sensitive information or clicking on malicious links, resulting in data leaks or other security incidents. It's like being served a delicious-looking dish, only to find out it was a trap!

Put simply

Think of it like a restaurant menu that looks perfect, but the waiter is sneaking in a side dish you didn’t order. Users might be tricked into interacting with fake buttons or links that appear legitimate, leading to confusion and potentially harmful actions. This vulnerability arises from an object lifecycle issue in the Media component of Google Chrome, allowing remote attackers to execute UI spoofing. By leveraging a specially crafted HTML page, an attacker can deceive users into thinking they're interacting with legitimate browser elements.

What to do

An attacker can manipulate the user interface to display deceptive information, making it seem like the browser is working as expected. This could lead to users accidentally revealing sensitive information or clicking on malicious links, resulting in data leaks or other security incidents. It's like being served a delicious-looking dish, only to find out it was a trap! To secure your experience, update Google Chrome to version 142.0.7444.59 or newer immediately. Regularly check for updates and consider enabling security features like Safe Browsing to add an extra layer of protection. 🛡️ You've got this! Keeping your browser updated is your best defense against such vulnerabilities. Stay secure! 🚀

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.00322 · 24.0th percentile
Weakness
CWE-290 · Authentication Bypass by Spoofing
Published
2025-11-11T01:15Z
Affected products (1)
ProductVersionsFixed in
google/chrome< 142.0.7444.59142.0.7444.59
References (2)
EPSS history
Timeline
  • 10 NOV 20:00Z
    Object lifecycle issue in Media in Google Chrome prior to 142.0.7444.59 allowed a remote attacker to perform UI spoofing via a crafted HTML page
    cvelistv5