CVE-2025-12729: Inappropriate implementation in Omnibox
Chromium: CVE-2025-12729 Inappropriate implementation in Omnibox
Other sources
Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
— MITRE
This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.
— Microsoft
Credit
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 142.0.7444.134 - Upgrade
Upgrade
Google Chrome on Androidto a version that resolves this vulnerability.Fixed in 142.0.7444.137
Event History
Peer vulnerabilities
Found alongside the following vulnerabilities.
Frequently Asked Questions
What is the severity of CVE-2025-12729?
CVE-2025-12729 has a high severity rating due to its potential for enabling UI spoofing attacks on users.
How do I fix CVE-2025-12729?
To fix CVE-2025-12729, update Google Chrome on Android to version 142.0.7444.137 or later.
Who is affected by CVE-2025-12729?
CVE-2025-12729 affects users of Google Chrome on Android versions prior to 142.0.7444.137.
Can CVE-2025-12729 be exploited remotely?
Yes, CVE-2025-12729 can be exploited remotely by convincing a user to perform specific UI gestures on a malicious HTML page.
What software is involved in CVE-2025-12729?
CVE-2025-12729 specifically involves Google Chrome and may also impact Microsoft Edge (Chromium-based) if it uses similar underlying components.