Cloud Vulnerability DB
An open project to list all known cloud vulnerabilities and Cloud Service Provider security issues
Vulnerability DatabaseCVE-2025-5066
CVE-2025-5066:
Google Chrome vulnerability analysis and mitigation
Overview
CVE-2025-5066 is a security vulnerability discovered in Google Chrome's Messages feature on Android. The vulnerability was reported by Mohit Raj (shadow2639) on July 31, 2024, and affects versions prior to 137.0.7151.55. The issue stems from an inappropriate implementation in the Messages component that could allow UI spoofing attacks (Chrome Releases, NVD).
Technical details
The vulnerability is classified as a Medium severity issue in Google Chrome's security assessment. It specifically affects the Messages component in Chrome on Android platforms, where an inappropriate implementation could allow UI spoofing attacks when a user is convinced to engage in specific UI gestures. The attack vector requires a crafted HTML page to exploit the vulnerability (Chrome Releases, CVE).
Impact
The vulnerability enables a remote attacker to perform UI spoofing attacks, but only if they can convince a user to engage in specific UI gestures. This could potentially lead to user deception through interface manipulation (NVD).
Mitigation and workarounds
Google has addressed this vulnerability in Chrome version 137.0.7151.55 for Android. Users are advised to update their Chrome browser to this version or later to mitigate the risk. The fix was included as part of a broader security update that addressed multiple vulnerabilities (Chrome Releases).
Additional resources
Source: This report was generated using AI
Free Vulnerability Assessment
Benchmark your Cloud Security Posture
Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.
Get a personalized demo
Ready to see Wiz in action?
“Best User Experience I have ever seen, provides full visibility to cloud workloads.”
David EstlickCISO
“Wiz provides a single pane of glass to see what is going on in our cloud environments.”
Adam FletcherChief Security Officer
“We know that if Wiz identifies something as critical, it actually is.”
Greg PoniatowskiHead of Threat and Vulnerability Management