CVE-2025-9867: Chrome Android Downloads UI Spoofing Fixed in Chrome 140

Google and the Chromium project have patched CVE-2025-9867, a medium-severity inappropriate implementation bug in the Downloads component that can be abused for UI spoofing on Chrome for Android, and users should update their mobile and desktop Chromium-based browsers immediately to eliminate the risk. (nvd.nist.gov, chromereleases.googleblog.com)

Background​

Chromium’s September 2025 patch cycle (Chrome 140) closed a collection of issues across the browser, including a cluster of inappropriate implementation bugs affecting Toolbar, Extensions and Downloads components; CVE-2025-9867 specifically targets the Downloads UI on Android and was marked by Chromium as Medium severity. Google shipped fixes as part of the Chrome 140 release family and published the stable release notes for Android and desktop channels in early September 2025. (chromereleases.googleblog.com)
The National Vulnerability Database (NVD) entry for CVE-2025-9867 summarizes the technical impact: a crafted HTML page can trigger a UI spoofing condition in the Downloads interface on affected Android builds of Chrome, allowing an attacker to misrepresent critical UI elements to the user. NVD lists the CVSS v3.1 vector and gives a base score consistent with medium-impact UI-manipulation vulnerabilities. (nvd.nist.gov)

---

What the vulnerability actually is​

Technical summary​

• The flaw is categorized under CWE-451: User Interface (UI) Misrepresentation of Critical Information, meaning the browser failed to faithfully represent the origin or authenticity of a UI element related to downloads. This can let a malicious webpage display or substitute UI controls or prompts that mimic legitimate browser dialogs or system download flows. (nvd.nist.gov)
• The attack surface is a crafted HTML page served over the network. Exploitation requires that a victim visits a malicious site and interacts with the page—UI spoofing is user-interaction dependent, not a blind remote code execution. The practical result is social-engineering amplification: an attacker can coax a user into revealing credentials, granting permissions, or interacting with a fraudulent download prompt. (nvd.nist.gov)

Affected software​

• The NVD entry and Chrome release notes indicate the fix was applied in the Chrome 140 release family; NVD explicitly references Android builds prior to the fixed version (the published fixed version data points to Chrome 140.0.7339.80 as the threshold for Android). Desktop builds in the same release family also received security fixes that include related bugs. Because Chromium’s release numbering differs across platforms, end users should rely on the update mechanism for each platform rather than raw version matching. (nvd.nist.gov, chromereleases.googleblog.com)

---

Why UI spoofing in Downloads matters​

Mobile browsers are compact, tactile environments where users make quick decisions; a convincing fake download prompt or a misrepresented toolbar can be enough to trick someone into allowing a malicious download or entering sensitive data. Unlike memory-corruption RCEs, UI spoofing:

• Requires less technical sophistication to weaponize into phishing attacks.
• Leverages human trust rather than code execution to achieve impact.
• Scales effectively because attackers only need to host a crafted page and persuade clicks or taps.

In short, while CVE-2025-9867 is not a remote code execution vulnerability, it is a credible enabler of credential theft, fraudulent transactions, and second-stage attacks that rely on users to take an action. The exploitability hinges on social engineering, which historically has been the most effective path for attackers to convert technical flaws into real-world compromise.

---

Patch and disclosure timeline​

• Chromium received the report and assigned CVE-2025-9867; the NVD published an entry on September 3, 2025, reflecting Chromium’s advisory. (nvd.nist.gov)
• Google rolled fixes into Chrome 140 for desktop and Android in the early-September 2025 stable updates; Android’s release notes for the Chrome 140 family were published on September 2, 2025. Google’s advisory notes that these releases include the security fixes in question. (chromereleases.googleblog.com)
• Press coverage the same week documented that Chrome 140 fixed multiple CVEs, with CVE-2025-9867 categorized as medium severity alongside other inappropriate implementation issues. Chromium’s security team also confirmed bug-bounty awards for some of the externally reported issues. (pcworld.com, securityweek.com)

Chromium’s public approach follows the usual practice: restrict exploit details until patches roll out, link the fix to the release, and credit researchers through the bounty program. That coordinated disclosure is healthy from a security posture perspective and reduces the window in which developers and vendors are blind to exploitation techniques.

---

Impact on Chromium-based browsers, including Microsoft Edge​

Chromium is the upstream project for multiple browsers, including Microsoft Edge (Chromium-based). Historically, Edge ingests Chromium security updates on its own cadence; Microsoft tracks Chromium fixes and publishes corresponding updates for Edge across release channels. Enterprise customers using Microsoft Edge should expect the Chromium fix to be integrated into Edge updates shortly after Google’s release and should follow Microsoft’s Security Update Guide and Edge release notes to confirm when their channel receives the patch. (learn.microsoft.com, msrc.microsoft.com)
Enterprises that delay Edge updates or run locked-down branches should plan a patch deployment after verifying the integrated Edge package contains the Chromium 140 fixes; mobile deployments using Edge for Android will likewise need attention as platform versioning differences can cause rollout timing to vary.

---

Practical exploitation scenario (what an attacker could do)​

• An attacker crafts a webpage that renders a fake download manager or system-level download permission prompt inside the browser’s viewport.
• The spoofed UI is visually convincing enough to hide the page origin, making the user believe the prompt is native to the browser or operating system.
• The user interacts with the fake UI—clicks to “accept” a download, enters credentials into a credential-capture form, or approves a permission.
• With those interactions the attacker obtains files, credentials, or other inputs that facilitate further compromise (malware delivery, account takeover, etc.).

Because the exploit relies on persuasion rather than memory corruption, automated detection is more challenging; defenders must rely on patching, content filtering, and user education.

---

Recommended actions for users and administrators​

For all users (mobile and desktop)​

• Update Chrome (or your Chromium-based browser) immediately to the latest stable version available on your platform via the official store or the browser’s update mechanism. This closes CVE-2025-9867 and the sibling fixes included in Chrome 140. (chromereleases.googleblog.com)
• On Android, open Google Play (or your managed app store) and verify that Chrome is at the most recent version offered for your device; accept updates promptly.
• Do not sideload or install browser packages from untrusted sources; platform update stores include safety checks that reduce exposure.
• Treat unexpected download prompts and credential requests with suspicion—especially if they appear immediately after visiting a new or unknown site.

For power users and enterprises​

• Validate the presence of the fix in your browser build before mass deployment—confirm the version string in Help → About or your management console matches the patched release family. (chromereleases.googleblog.com)
• For Microsoft Edge administrators, consult Microsoft’s Edge release notes and the Security Update Guide to identify the Edge build that incorporates the Chromium 140 fixes, and schedule phased deployments through your enterprise update tooling. (learn.microsoft.com, msrc.microsoft.com)
• Use Mobile Device Management (MDM) to enforce app updates on corporate Android devices and block sideloading.
• Implement network-level protections—URL filtering and secure web gateways can block known malicious hosts and reduce exposure to crafted pages.
• Educate users with short, actionable guidance: never enter credentials into pages reached by unsolicited links and verify download prompts’ provenance.

---

Defensive measures beyond patching​

• Enable browser-safe features such as Safe Browsing (or equivalent) and keep browser extensions to a minimum; malicious extensions can amplify a UI-spoofing attack if they can inject content.
• For high-risk use cases, consider policy controls that restrict downloads to whitelisted domains or that require downloads to be sandbox-scanned before allowing execution.
• Use password managers: they help prevent credential capture by refusing to auto-fill credentials into mismatched URLs or injected UI controls.
• Employ content security tools and endpoint protections that flag anomalous downloads or downloads originating from newly observed domains.

---

Strengths and weaknesses of the response​

Notable strengths​

• Google’s inclusion of the fix in the broadly rolled Chrome 140 release family demonstrates coordinated disclosure and a reasonable patching cadence. The release covered multiple components and included external researcher credits, indicating active community reporting and triage. (chromereleases.googleblog.com, securityweek.com)
• Publication of the fix across desktop and mobile channels reduces asymmetric exposure—mobile users receive the same fixes, albeit with slightly different version labels, which helps lower the window for exploitation.

Risks and remaining concerns​

• UI-spoofing vulnerabilities are human-centric and thus remain dangerous even after patches; many organizations rely on user training, which is imperfect. A patched browser prevents exploitation only when the end user actually updates in a timely manner.
• Platform version inconsistencies and staggered rollouts across app stores, mobile carriers, and vendor-managed devices can leave pockets of vulnerable users for days or weeks. Administrators using older Edge/Chromium branches or who delay updates for compatibility testing may be exposed during that window. (learn.microsoft.com)
• Details about the exact exploitation techniques remain limited; Chromium teams keep bug specifics restricted until updates have sufficiently propagated. That policy reduces short-term risk but can frustrate defenders who need indicators of compromise. When exploit details are withheld, defenders must assume worst-case scenarios and accelerate patching.

---

How serious is CVE-2025-9867 compared with other recent Chromium fixes?​

CVE-2025-9867 sits in the medium tier of severity alongside other inappropriate implementation issues resolved in the same Chrome 140 update. It is less severe than high-impact memory corruption bugs (for example, use-after-free vulnerabilities in V8 that can enable remote code execution), but it is more immediately exploitable for phishing-style outcomes because it targets the user’s perception rather than program memory. In practice, a well-crafted UI-spoofing attack can be highly effective and cause real-world losses without ever achieving code execution.
Security reportage and vendor advisories from the Chrome 140 rollout emphasize that no active exploitation in the wild was observed at the time of disclosure, but that status can change if researchers or attackers develop public proof-of-concept pages. The prudent posture is to patch quickly and assume attackers will attempt to weaponize such social-engineering-friendly bugs. (pcworld.com, securityweek.com)

---

Special considerations for developers and extension authors​

Browser extensions that interact with the Downloads API, or that inject UI into the browser chrome or page content, should audit their interaction surfaces for assumptions about download flows and UI trust boundaries. An extension that exposes privileged download UI without proper origin checks or messaging could exacerbate the impact of a UI-spoofing flaw.
Developers maintaining web apps that present download prompts should avoid behaviors that mimic browser UI or system dialogs; clear branding, origin indicators, and contextual confirmation prompts help users distinguish legitimate browser chrome from page content.

---

Final verdict and takeaways​

CVE-2025-9867 is a reminder that not all impactful browser vulnerabilities are memory-safety bugs; some attack vectors exploit trust and perception. The patch delivered by Chromium as part of Chrome 140 mitigates a credible UI-spoofing vector in the Downloads component for Android and related platforms. Immediate, pragmatic steps are straightforward:

• Update Chrome and Chromium-based browsers (including Microsoft Edge) to the latest stable releases available for your platform. (chromereleases.googleblog.com, learn.microsoft.com)
• For organizations, accelerate testing and deployment of patched builds using standard change-control processes, while enforcing app-update policies for mobile devices.
• Complement patching with user education and additional layers of defense (password managers, URL filtering, and endpoint controls).

Patching removes the technical vulnerability; the human element remains. For maximum protection, combine timely updates with defensive policies and continuous user-awareness reinforcement.

---

Source: MSRC Security Update Guide - Microsoft Security Response Center