BaseFortify

Publication date: 2025-12-02

Last updated on: 2025-12-04

Assigner: Chrome

Description

Inappropriate implementation in Downloads in Google Chrome prior to 143.0.7499.41 allowed a remote attacker who convinced a user to engage in specific UI gestures to bypass download protections via a crafted HTML page. (Chromium security severity: Low)

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-12-02

Last Modified

2025-12-04

Generated

2026-07-06

AI Q&A

2025-12-02

EPSS Evaluated

2026-07-05

NVD

CVE-2025-13637

Affected Vendors & Products

Vendor	Product	Version / Range
google	chrome	to 143.0.7499.40 (exc)
google	chrome	to 143.0.7499.40 (exc)
apple	macos	*
microsoft	windows	*
linux	linux_kernel	From 5.15.160 (inc) to 5.16 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-449	The UI performs the wrong action with respect to the user's request.

Attack-Flow Graph

Executive Summary

This vulnerability is an inappropriate implementation in the Downloads feature of Google Chrome versions prior to 143.0.7499.41. It allows a remote attacker to bypass download protections by convincing a user to perform specific user interface gestures on a crafted HTML page.

Impact Analysis

The vulnerability could allow an attacker to bypass download protections, potentially leading to unauthorized or harmful files being downloaded onto a user's system if the user is tricked into performing certain UI actions.

Mitigation Strategies

Update Google Chrome to version 143.0.7499.41 or later to ensure the vulnerability is patched and download protections are effective.

Hi! I’m here to help you understand CVE-2025-13637. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70