CVE-2025-1922 - Vulnerability Details

Vendors	Products
Google	Android Chrome

Link	Providers
https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html
https://issues.chromium.org/issues/384033062

Type	Values Removed	Values Added
First Time appeared		Google Google android Google chrome
CPEs		cpe:2.3:a:google:chrome:::::::: cpe:2.3:o:google:android:-:::::::*
Vendors & Products		Google Google android Google chrome

Type	Values Removed	Values Added
Metrics		cvssV3_1 `{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)
Weaknesses		CWE-451
References		https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html https://issues.chromium.org/issues/384033062

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2025-1922", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "state": "PUBLISHED", "assignerShortName": "Chrome", "dateReserved": "2025-03-04T01:10:25.226Z", "datePublished": "2025-03-05T03:48:37.428Z", "dateUpdated": "2025-03-05T14:23:17.785Z"}, "containers": {"cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"version": "134.0.6998.35", "status": "affected", "lessThan": "134.0.6998.35", "versionType": "custom"}]}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "Inappropriate implementation", "cweId": "CWE-451"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2025-03-05T03:48:37.428Z"}, "references": [{"url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html"}, {"url": "https://issues.chromium.org/issues/384033062"}]}, "adp": [{"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2025-03-05T14:22:46.444000Z", "id": "CVE-2025-1922", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T14:23:17.785Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2025-1922 (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

state : PUBLISHED (string)

assignerShortName : Chrome (string)

dateReserved : 2025-03-04T01:10:25.226Z (string)

datePublished : 2025-03-05T03:48:37.428Z (string)

dateUpdated : 2025-03-05T14:23:17.785Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

version : 134.0.6998.35 (string)

status : affected (string)

lessThan : 134.0.6998.35 (string)

versionType : custom (string)

}

]

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

description : Inappropriate implementation (string)

cweId : CWE-451 (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2025-03-05T03:48:37.428Z (string)

}

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/384033062 (string)

}

]

}

adp : [ »

0 : { »

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2025-03-05T14:22:46.444000Z (string)

id : CVE-2025-1922 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-05T14:23:17.785Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2025-1922", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-03-05T14:22:46.444000Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-03-05T14:23:10.776Z"}}], "cna": {"affected": [{"vendor": "Google", "product": "Chrome", "versions": [{"status": "affected", "version": "134.0.6998.35", "lessThan": "134.0.6998.35", "versionType": "custom"}]}], "references": [{"url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html"}, {"url": "https://issues.chromium.org/issues/384033062"}], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}], "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-451", "description": "Inappropriate implementation"}]}], "providerMetadata": {"orgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "shortName": "Chrome", "dateUpdated": "2025-03-05T03:48:37.428Z"}}}, "cveMetadata": {"cveId": "CVE-2025-1922", "state": "PUBLISHED", "dateUpdated": "2025-03-05T14:23:17.785Z", "dateReserved": "2025-03-04T01:10:25.226Z", "assignerOrgId": "ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28", "datePublished": "2025-03-05T03:48:37.428Z", "assignerShortName": "Chrome"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

cvssV3_1 : { »

scope : UNCHANGED (string)

version : 3.1 (string)

baseScore : 4.3 (number)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

integrityImpact : LOW (string)

userInteraction : REQUIRED (string)

attackComplexity : LOW (string)

availabilityImpact : NONE (string)

privilegesRequired : NONE (string)

confidentialityImpact : NONE (string)

}

1 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2025-1922 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2025-03-05T14:22:46.444000Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2025-03-05T14:23:10.776Z (string)

}

]

cna : { »

affected : [ »

0 : { »

vendor : Google (string)

product : Chrome (string)

versions : [ »

0 : { »

status : affected (string)

version : 134.0.6998.35 (string)

lessThan : 134.0.6998.35 (string)

versionType : custom (string)

}

]

}

]

references : [ »

0 : { »

url : https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html (string)

}

1 : { »

url : https://issues.chromium.org/issues/384033062 (string)

}

]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

cweId : CWE-451 (string)

description : Inappropriate implementation (string)

}

]

}

]

providerMetadata : { »

orgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

shortName : Chrome (string)

dateUpdated : 2025-03-05T03:48:37.428Z (string)

}

cveMetadata : { »

cveId : CVE-2025-1922 (string)

state : PUBLISHED (string)

dateUpdated : 2025-03-05T14:23:17.785Z (string)

dateReserved : 2025-03-04T01:10:25.226Z (string)

assignerOrgId : ebfee0ef-53dd-4cf3-9e2a-08a5bd7a7e28 (string)

datePublished : 2025-03-05T03:48:37.428Z (string)

assignerShortName : Chrome (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "matchCriteriaId": "CCEA13AF-B0C2-4D3A-A4DA-60C02F7FC46D", "versionEndExcluding": "134.0.6998.35", "vulnerable": true}], "negate": false, "operator": "OR"}, {"cpeMatch": [{"criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26", "vulnerable": false}], "negate": false, "operator": "OR"}], "operator": "AND"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}, {"lang": "es", "value": "Una implementaci\u00f3n inadecuada en Selection en Google Chrome en Android anterior a la versi\u00f3n 134.0.6998.35 permiti\u00f3 que un atacante remoto convenciera a un usuario para que realizara gestos espec\u00edficos de la interfaz de usuario para realizar una suplantaci\u00f3n de la interfaz de usuario a trav\u00e9s de una p\u00e1gina HTML manipulada. (Gravedad de seguridad de Chromium: baja)"}], "id": "CVE-2025-1922", "lastModified": "2025-04-01T20:41:48.893", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 1.4, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2025-03-05T04:15:11.887", "references": [{"source": "chrome-cve-admin@google.com", "tags": ["Release Notes"], "url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html"}, {"source": "chrome-cve-admin@google.com", "tags": ["Permissions Required"], "url": "https://issues.chromium.org/issues/384033062"}], "sourceIdentifier": "chrome-cve-admin@google.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-451"}], "source": "chrome-cve-admin@google.com", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* (string)

matchCriteriaId : CCEA13AF-B0C2-4D3A-A4DA-60C02F7FC46D (string)

versionEndExcluding : 134.0.6998.35 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

1 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:google:android:-:*:*:*:*:*:*:* (string)

matchCriteriaId : F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26 (string)

vulnerable : false (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

operator : AND (string)

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Inappropriate implementation in Selection in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low) (string)

}

1 : { »

lang : es (string)

value : Una implementación inadecuada en Selection en Google Chrome en Android anterior a la versión 134.0.6998.35 permitió que un atacante remoto convenciera a un usuario para que realizara gestos específicos de la interfaz de usuario para realizar una suplantación de la interfaz de usuario a través de una página HTML manipulada. (Gravedad de seguridad de Chromium: baja) (string)

}

]

id : CVE-2025-1922 (string)

lastModified : 2025-04-01T20:41:48.893 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.3 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : NONE (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 1.4 (number)

source : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

type : Secondary (string)

}

]

}

published : 2025-03-05T04:15:11.887 (string)

references : [ »

0 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Release Notes (string)

]

url : https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html (string)

}

1 : { »

source : chrome-cve-admin@google.com (string)

tags : [ »

0 : Permissions Required (string)

]

url : https://issues.chromium.org/issues/384033062 (string)

}

]

sourceIdentifier : chrome-cve-admin@google.com (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-451 (string)

}

]

source : chrome-cve-admin@google.com (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation none

Automatable no

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object