CVE-2025-13102

Description

Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:google:android:-:*:*:*:*:*:*:* - NOT VULNERABLE

Google Chrome on Android < 134.0.6998.35

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-13102 PoC: UI Spoofing in WebApp Installs -->
<!DOCTYPE html>
<html>
<head>
    <meta charset="UTF-8">
    <meta name="viewport" content="width=device-width, initial-scale=1.0">
    <title>Fake App Installer</title>
    <style>
        body { font-family: Arial, sans-serif; padding: 20px; }
        .fake-install-dialog {
            border: 2px solid #4285f4;
            border-radius: 8px;
            padding: 20px;
            max-width: 300px;
            background: #fff;
            box-shadow: 0 2px 10px rgba(0,0,0,0.2);
        }
        .fake-app-icon {
            width: 64px;
            height: 64px;
            background: linear-gradient(45deg, #4285f4, #34a853);
            border-radius: 12px;
            margin-bottom: 15px;
        }
        .fake-app-name { font-weight: bold; font-size: 18px; color: #333; }
        .fake-publisher { color: #666; font-size: 14px; margin: 5px 0; }
        .fake-permissions { font-size: 12px; color: #888; margin-top: 10px; }
        .install-btn {
            background: #4285f4;
            color: white;
            border: none;
            padding: 10px 20px;
            border-radius: 4px;
            cursor: pointer;
            margin-top: 15px;
        }
        .install-btn:hover { background: #3367d6; }
        .spoofed-indicator {
            color: red;
            font-size: 10px;
            margin-top: 5px;
        }
    </style>
</head>
<body>
    <h2>Chrome Android UI Spoofing PoC</h2>
    <p>This PoC demonstrates how an attacker could spoof the WebApp installation dialog.</p>
    
    <div class="fake-install-dialog">
        <div class="fake-app-icon"></div>
        <div class="fake-app-name">Google Play Store</div>
        <div class="fake-publisher">Published by Google LLC</div>
        <div class="fake-permissions">
            This app will have access to:
            <ul>
                <li>Your location</li>
                <li>Camera and microphone</li>
                <li>All files on device</li>
                <li>Payment information</li>
            </ul>
        </div>
        <button class="install-btn" onclick="alert('Install button clicked - UI spoofed!')">Install</button>
        <div class="spoofed-indicator">[ATTACKER CONTROLLED CONTENT]</div>
    </div>

    <script>
        // Simulate the UI spoofing behavior
        console.log('CVE-2025-13102 PoC loaded');
        console.log('This demonstrates how malicious pages can spoof Chrome\'s WebApp install UI');
        
        // The actual exploitation would require:
        // 1. Abusing the beforeinstallprompt API or installation flow
        // 2. Manipulating the display of install confirmation dialog
        // 3. Tricking users into installing a malicious web app
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13102
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13102
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13102/
[4] VulDB https://vuldb.com/cve/CVE-2025-13102
[5] https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html
[6] https://issues.chromium.org/issues/351564774

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13102", "sourceIdentifier": "[email protected]", "published": "2025-11-14T03:15:56.563", "lastModified": "2025-11-17T12:18:45.040", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in WebApp Installs in Google Chrome on Android prior to 134.0.6998.35 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-451"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "versionEndExcluding": "134.0.6998.35", "matchCriteriaId": "CCEA13AF-B0C2-4D3A-A4DA-60C02F7FC46D"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:google:android:-:*:*:*:*:*:*:*", "matchCriteriaId": "F8B9FEC8-73B6-43B8-B24E-1F7C20D91D26"}]}]}], "references": [{"url": "https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop.html", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://issues.chromium.org/issues/351564774", "source": "[email protected]", "tags": ["Issue Tracking"]}]}}