CVE-2025-3073 describes an inappropriate implementation in Google Chrome's Autofill feature, affecting versions prior to 135.0.7049.52. This vulnerability allows a remote attacker to perform UI spoofing through a crafted HTML page, provided the user engages in specific UI gestures. With a CVSS score of 5.4 (Medium), the attack requires user interaction (UI:R) but has low impact on confidentiality and integrity (C:L, I:L). There is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the KEV catalog, though it has received minimal community discussion and media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 135.0.7049.52CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
>= 135.0.7049.52, < 135.0.7049.52CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.