Google Chrome CVE-2025-14373

Requires the victim to be running Google Chrome for Android at a version prior to 143.0.7499.110 AND to actively navigate to an attacker-controlled crafted HTML page (UI:R - user interaction is mandatory). The flaw is in the mobile browser Toolbar's UI rendering, so it does not affect desktop Chrome per the vendor description. No authentication or special configuration is needed, but exploitation is limited to deception (domain spoofing to enable phishing) - it does not grant code execution, data theft, or session compromise on its own, and depends entirely on the user being fooled by the spoofed address bar.

This is a genuinely low-priority issue despite being a browser vulnerability in an ubiquitous product. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N, base 4.3) correctly caps impact at low: the only consequence is domain/address-bar spoofing (C:L), with no integrity or availability impact and no code execution. Chromium itself rated the security severity as Medium. EPSS is low at 0.27% (18th percentile), consistent with a UI-spoofing bug that is awkward to weaponize at scale. There is no CISA KEV listing and no public exploit identified at time of analysis, so this is no public exploit identified at time of analysis rather than active exploitation. The one signal requiring caution: the description explicitly scopes this to Chrome on Android, but the CPE string (cpe:2.3:a:google:chrome:*) is the generic, platform-agnostic Chrome entry - the Android-only condition comes from the description, not the CPE, so defenders should treat desktop Chrome as unaffected per the vendor text. No conflicting CVSS-vs-description access-vector issue exists here (both agree on remote + user interaction).

A remote attacker hosts a crafted HTML page and lures an Android Chrome user (version before 143.0.7499.110) to open it, typically via a phishing link. The page abuses the Toolbar's UI rendering so the address bar displays a trusted domain while attacker-controlled content is shown, tricking the victim into trusting a spoofed site. No public exploit code is available, and success depends on the victim interacting with the malicious page.