CVE-2025-12728: Inappropriate implementation in Omnibox
Chromium: CVE-2025-12728 Inappropriate implementation in Omnibox
Other sources
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 142.0.7444.134 - Upgrade
Upgrade
Google Chrome on Androidto a version that resolves this vulnerability.Fixed in 142.0.7444.137
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-12728?
The severity of CVE-2025-12728 is classified as high due to its potential for remote exploitation.
How do I fix CVE-2025-12728?
To fix CVE-2025-12728, update Google Chrome on Android to version 142.0.7444.137 or later.
What type of attack does CVE-2025-12728 involve?
CVE-2025-12728 involves UI spoofing attacks that can be executed through crafted HTML pages.
Which software versions are affected by CVE-2025-12728?
Google Chrome on Android versions prior to 142.0.7444.137 are affected by CVE-2025-12728.
Is Microsoft Edge (Chromium-based) vulnerable to CVE-2025-12728?
Yes, Microsoft Edge (Chromium-based) may also be affected by CVE-2025-12728, and it is recommended to check for updates.