PT-2025-1280 · Google+5 · Google Chrome+5

Hafiizh · Publicado 2025-01-14 · Atualizado 2025-07-02 · CVE-2025-0439

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Google Chrome versions prior to 132.0.6834.83 Microsoft Edge versions (affected versions not specified)

Description The issue is related to a race condition in the Frames component of Google Chrome and Microsoft Edge, allowing a remote attacker to bypass authentication through spoofing. This can be achieved by convincing a user to perform specific UI gestures, enabling the attacker to perform UI spoofing via a crafted HTML page.

Recommendations For Google Chrome versions prior to 132.0.6834.83, update to version 132.0.6834.83 or later to resolve the issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Race Condition

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-362

CWE-290

Identificadores relacionados

ALT-PU-2025-1607

ALT-PU-2025-3969

ALT-PU-2025-4366

ALT-PU-2025-7539

ALT-PU-2025-8547

BDU:2025-00748

CVE-2025-0439

DSA-5844-1

OPENSUSE-SU-2025:0018-1

OPENSUSE-SU-2025:14659-1

Produtos afetados

Alt Linux

Astra Linux

Debian

Google Chrome

Edge

Red Os

Referências · 45

• 🔥 https://issues.chromium.org/issues/371247941 · Exploit
• https://bugzilla.suse.com/1235892 · Nota
• https://suse.com/security/cve/CVE-2025-0448 · Nota
• https://t.me/cvenotify/107472 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-0439 · Nota de Segurança
• https://suse.com/security/cve/CVE-2025-0439 · Nota
• https://bdu.fstec.ru/vul/2025-00748 · Nota de Segurança
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-chromium-070325 · Nota
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1 · Nota
• https://suse.com/security/cve/CVE-2025-0436 · Nota
• https://lists.opensuse.org/archives/list/[e-mail]/thread/ZD2ADQJZD65W3SVFFMLWFJLHFFBUI5YK · Nota
• https://t.me/cvenotify/119256 · Publicação no Telegram
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2025-0439 · Nota
• https://suse.com/security/cve/CVE-2025-0442 · Nota
• https://suse.com/security/cve/CVE-2025-0438 · Nota