CVE-2025-3072

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Inappropriate implementation in Custom Tabs in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-451

Affected software

Vendor	Product	Versions
Google	Chrome	>= 135.0.7049.52, < 135.0.7049.52

References

https://chromereleases.googleblog.com/2025/04/stable-channel-update-for-desktop.htmlRelease Notes
https://issues.chromium.org/issues/362545037Permissions Required

Timeline

Published: Apr 2, 2025
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2025

CVE-2025-307206.1Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Orders). Supported versions that are affected are 1 CVE-2025-307214.0Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: UDF). Supported versions that are affected are 8.0.0-8.0.41, CVE-2025-307226.8Vulnerability in the MySQL Client product of Oracle MySQL (component: Client: mysqldump). Supported versions that are affected are 8.0.0-8.CVE-2025-307235.4Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.CVE-2025-307247.5Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: XML Services). Supported versions that are affected are 7.CVE-2025-307256.7Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core). The supported version that is affected is 7.CVE-2025-307265.3Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are af CVE-2025-307279.8Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: iSurvey Module). Supported versions that are affected CVE-2025-307287.5Vulnerability in the Oracle Configurator product of Oracle E-Business Suite (component: Core). Supported versions that are affected are 12.CVE-2025-307295.5Vulnerability in the Oracle Communications Order and Service Management product of Oracle Communications Applications (component: Security).CVE-2025-30735.4Inappropriate implementation in Autofill in Google Chrome prior to 135.0.7049.52 allowed a remote attacker who convinced a user to engage in CVE-2025-307307.5Vulnerability in the Oracle Application Object Library product of Oracle E-Business Suite (component: Core). Supported versions that are af