Cyber Resilience

CVE-2025-0996

Google Chrome ≤ 133.0.6943.98

Published
15 February 2025
Modified
10 April 2025
CVSS Score v3.1 5.4
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N
EPSS Score 0.0036 29th percentile
Risk Priority 43 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2025-0996 is a medium-severity Insufficient Visual Distinction of Homoglyphs Presented to User (CWE-1007) vulnerability in Google Chrome. Its CVSS base score is 5.4 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Match Legitimate Resource Name or Location (T1036.005); ranked at the 29th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Inappropriate implementation in Browser UI in Google Chrome on Android prior to 133.0.6943.98 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page. (Chromium security severity: High)

CWE(s)
CWE-1007

Related Threats

MITRE ATT&CK Enterprise Techniques

T1036.005 Match Legitimate Resource Name or Location Stealth
Adversaries may match or approximate the name or location of legitimate files, Registry keys, or other resources when naming/placing them.
attack.mitre.org →
T1036 Masquerading Stealth
Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools.
attack.mitre.org →
T1566 Phishing Initial Access
Adversaries may send phishing messages to gain access to victim systems.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2026-14381Same product: Google Chrome
CVE-2026-13984Same product: Google Chrome
CVE-2026-11001Same product: Google Chrome
CVE-2026-13985Same product: Google Chrome
CVE-2023-2937Same product: Google Chrome
CVE-2023-7011Same product: Google Chrome
CVE-2023-7282Same product: Google Chrome
CVE-2026-13989Same product: Google Chrome
CVE-2023-0700Same product: Google Chrome
CVE-2025-12911Same product: Google Chrome

Affected Assets

google
chrome
≤ 133.0.6943.98

Mitigating Controls

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.25 Secure development life cycle partial match
degrades

Secure development lifecycle can require UI design standards that improve glyph distinguishability.

A.8.26 Application security requirements partial match
prevents

Application security requirements can mandate visual safeguards against homoglyph confusion.

A.8.27 Secure system architecture and engineering principles partial match
prevents

Secure architecture principles can include user-interface protections that reduce visual ambiguity.

A.8.28 Secure coding partial match
degrades

Secure coding standards can enforce font or rendering choices that distinguish similar glyphs.

A.8.29 Security testing in development and acceptance partial match
finds

Security testing can detect and require fixes for insufficient visual distinction of homoglyphs.

References