CVE-2025-13636

MediumCVSS 4.3/10Last modified Sep 25, 2026

Description

Inappropriate implementation in Split View in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted domain name. (Chromium security severity: Low)

Metrics

CVSS 3.1 4.3/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Weakness enumeration

CWE-290

Affected software

No affected versions have been published.

Timeline

Published: Dec 2, 2025
Last modified: Sep 25, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-136374.3Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage i CVE-2025-136388.8Use after free in Media Stream in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to potentially exploit heap corruption via CVE-2025-136398.1Inappropriate implementation in WebRTC in Google Chrome prior to 143.0.7499.41 allowed a remote attacker to perform arbitrary read/write via CVE-2025-13646.6A vulnerability has been found in MicroWord eScan Antivirus 7.0.32 on Linux and classified as critical. Affected by this vulnerability is th CVE-2025-136403.5Inappropriate implementation in Passwords in Google Chrome prior to 143.0.7499.41 allowed a local attacker to bypass authentication via phys CVE-2025-136418.8The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is vulnerable to Local File Inclusion in all versions CVE-2025-136425.4The Paid Membership Plugin, Ecommerce, User Registration Form, Login Form, User Profile & Restrict Content – ProfilePress plugin for WordPre CVE-2025-136436.5A user with access to the cluster with a limited set of privilege actions may be able to terminate queries that are being executed by other CVE-2025-136447.5MongoDB Server may experience an invariant failure during batched delete operations when handling documents. The issue arises when the serve CVE-2025-136457.2The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file deletion due to insufficient file path validation in the 'ajax CVE-2025-136466.6The Modula Image Gallery plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the 'ajax_unzip CVE-2025-136486.1An attacker with access to the web application ZeusWeb of the provider Microcom (in this case, registration is required) who has the vulne