CVE-2025-12729

MediumCVSS 4.2/10Last modified Oct 7, 2026

Description

Inappropriate implementation in Omnibox in Google Chrome on Android prior to 142.0.7444.137 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)

Metrics

CVSS 3.1 4.2/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
Google	Chrome	>= 142.0.7444.137, < 142.0.7444.137

References

https://chromereleases.googleblog.com/2025/11/stable-channel-update-for-desktop.htmlRelease Notes, Vendor Advisory
https://issues.chromium.org/issues/454354281Issue Tracking, Permissions Required

Timeline

Published: Nov 10, 2025
Last modified: Oct 7, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-12737.8A maliciously crafted PDF file, when linked or imported into Autodesk applications, can force a Heap-Based Overflow vulnerability. A malicio CVE-2025-127324.3The WP Import – Ultimate CSV XML Importer for WordPress plugin for WordPress is vulnerable to unauthorized access of sensitive information d CVE-2025-127338.8The Import any XML, CSV or Excel File to WordPress (WP All Import) plugin for WordPress is vulnerable to Remote Code Execution in all versio CVE-2025-127343.5GitLab has remediated an issue in GitLab CE/EE affecting all versions from 15.6 before 18.4.6, 18.5 before 18.5.4, and 18.6 before 18.6.2 th CVE-2025-127359.8The expr-eval library is a JavaScript expression parser and evaluator designed to safely evaluate mathematical expressions with user-defined CVE-2025-127366.5in OpenHarmony v5.0.3 and prior versions allow a local attacker case sensitive information leak through use of uninitialized resource.CVE-2025-127378.4The administrative operations within the Carbon Console do not adequately validate specific user-supplied input. This oversight allows a mal CVE-2025-127381.3Neo4j Enterprise edition versions prior to 2025.11.2 and 5.26.17 are vulnerable to a potential information disclosure by an attacker who has CVE-2025-127397.3An attacker with viewer permissions in Looker could craft a malicious URL that, when opened by a Looker admin, would execute an attacker-sup CVE-2025-12747.8A maliciously crafted RCS file, when parsed through Autodesk Revit, can force an Out-of-Bounds Write vulnerability. A malicious actor may le CVE-2025-127407.7A Looker user with a Developer role could create a database connection using IBM DB2 driver and, by manipulating LookML, cause Looker to exe CVE-2025-127417.7A Looker user with Developer role could create a database connection using Denodo driver and, by manipulating LookML, cause Looker to execut