Chrome 140 for Android Fixes UI Spoofing Bug That Could Trick Users into Malicious Downloads

Google’s September 2025 stable channel update for Chrome, version 140, patches a UI spoofing vulnerability in the Downloads component that could allow attackers to mislead Android users into harmful actions. Tracked as CVE-2025-9867, the bug earned a medium severity rating from Chromium and highlights how interface manipulation can bypass traditional security defenses by targeting human perception rather than code execution.

Understanding CVE-2025-9867

The National Vulnerability Database (NVD) published details of the flaw on September 3, 2025, classifying it under CWE-451: User Interface (UI) Misrepresentation of Critical Information. In plain terms, Chrome for Android failed to properly display the origin and authenticity of UI elements related to downloads. A remote attacker could exploit this by crafting a malicious HTML page that injects fake download prompts or overlays that mimic the browser’s native interface.

The CISA ADP CVSS v3.1 base score is 5.4, with a vector of AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N. This means the attack requires no privileges and low complexity, but demands user interaction. The impact scope is unchanged, with low confidentiality and integrity impact—enough to trick a user into downloading a malicious file or revealing credentials.

Google’s advisory notes the affected platform as Chrome on Android prior to version 140.0.7339.80. Desktop Chrome received corresponding security improvements in the same release, but the Downloads spoofing issue is specific to mobile. The bug stems from an “inappropriate implementation,” a common root cause category in Chromium security that often points to flawed logic in handling trusted UI elements.

The Mechanics of UI Spoofing in Mobile Browsers

UI spoofing exploits the user’s trust in the browser’s visual cues. On a smartphone, screen real estate is tight, and users frequently tap through dialog boxes without careful inspection. A crafted page can render a button or prompt that appears to be a system-level download confirmation or a login screen for a legitimate service. Because the browser fails to correctly anchor the UI to its origin, the user may believe the dialog is genuine.

For example, an attacker could host a page that looks like a popular app store, then overlay a fake “Download now” button that triggers an APK sideload. Alternatively, a spoofed credentials prompt could harvest passwords for banking or social media accounts. The exploit requires no memory corruption or sandbox escape—just a convincing visual lie.

This type of attack is particularly dangerous because it sidesteps many automated defenses. Endpoint detection systems that scan for exploit patterns in memory won’t flag a crafted HTML page. Instead, defense relies on patching the browser and training users to recognize fraudulent UI.

The Chrome 140 Patch and Disclosure Timeline

The fix was integrated into the Chrome 140 release family, which began rolling out September 2, 2025, for Android and desktop. The NVD entry went live the following day, and Chromium’s public issue tracker (ID 415496161) confirmed the patch. Google’s security team withheld technical specifics until the update was in distribution, a standard coordinated disclosure practice.

A timeline of key events:

The Chromium release notes for stable channel updates acknowledge the fix alongside several other medium-severity inappropriate implementation bugs affecting Toolbar, Extensions, and Downloads. Bug bounty rewards were issued, though individual researcher names were not immediately disclosed.

Wider Impact on Chromium Ecosystem

Because Microsoft Edge, Brave, Opera, Samsung Internet, and many other browsers build on Chromium, they inherit these security patches. Microsoft typically integrates upstream Chromium fixes into Edge within days. The Microsoft Security Response Center (MSRC) already lists CVE-2025-9867 in its update guide, and enterprise administrators using Edge should watch for the corresponding stable channel release to confirm patch uptake.

For organizations managing a fleet of Android devices, the patch rollout may be inconsistent. Google Play’s staged deployments can take days to reach all users, and some carrier-locked devices may lag further. This patch gap is a known weakness of the mobile ecosystem and one that attackers are quick to exploit.

Why This Matters: Mobile Trust and Security

UI spoofing bugs sit in a unique threat category. They are not as flashy as remote code execution or sandbox escapes, but they are often more immediately weaponizable for phishing and fraud. A single convincing prompt can lead to credential theft, fraudulent transactions, or malware installation without requiring an exploit chain.

The CISA Stakeholder-Specific Vulnerability Categorization (SSVC) decision tree for this CVE assigned an exploitation status of “none” and a technical impact of “partial.” That indicates no observed active exploitation at the time of disclosure, but partial technical impact means the bug can still cause real harm if exploited. Social-engineering bugs frequently transition to “active exploitation” status once proof-of-concept code circulates—so delay is dangerous.

Compared to memory corruption bugs patched in the same Chrome 140 release, CVE-2025-9867 requires less attacker sophistication and can be scaled easily by hosting malicious pages on cheap infrastructure. For cybercriminals specializing in phishing, this type of vulnerability is a force multiplier.

Defensive Playbook: What to Do Now

For Individual Users

• Update Chrome on Android immediately: Open Google Play, navigate to Chrome, and install the latest version (140.0.7339.80 or higher). Verify the version under Settings > About Chrome.
• Update desktop browsers: Although the Downloads spoof targets Android, desktop Chrome and Edge users should apply all pending updates to pick up other security fixes from the 140 release family.
• Scrutinize prompts: If a website suddenly asks you to download a file or enter credentials, pause. Check the address bar to see if the request originates from the site you intended to visit.
• Enable Enhanced Safe Browsing: This Chrome feature compares site URLs against Google’s real-time blocklist and can warn you about known malicious pages.

For Enterprises

• Force updates via MDM: Use mobile device management (Microsoft Intune, VMware Workspace ONE, etc.) to mandate the latest Chrome version on corporate Android devices. Block sideloading of APKs to prevent users from installing outdated browser versions.
• Validate Edge deployment: For Microsoft Edge, monitor the MSRC advisory for CVE-2025-9867 and deploy the fixed build through Windows Update for Business or your software distribution tool.
• Implement network defenses: Secure web gateways, DNS filtering, and URL reputation services can block connections to known phishing domains hosting spoofed UI.
• Use app allowlisting: Restrict downloads to only trusted domains through Chrome policies, or use Microsoft Defender for Endpoint to scan downloaded files.
• Train users: Conduct short, focused education sessions: “Never enter credentials on pages reached via email links; verify the URL before tapping.” Password managers also help by refusing to auto-fill on mismatched domains.

Complementary Security Layers

• Deploy password managers: They prevent credential capture by never auto-filling into a form that doesn’t match the stored origin.
• Restrict browser extensions: Keep extensions to a minimum, as a compromised or malicious extension could amplify UI spoofing by injecting additional deceptive elements.
• Monitor for suspicious download behavior: EDR solutions can flag downloads from newly registered domains or unusual file types.

Remaining Challenges and the Human Factor

No patch can eliminate the human element. Even after users update, attackers will find new ways to manipulate perception. UI spoofing exploits cognitive shortcuts that are hard to train out, especially on mobile devices where interaction speed is prioritized.

Patching gaps remain a critical weakness. Android fragmentation means some devices may not receive the update for weeks, leaving a long window of exposure. Enterprises that require extensive compatibility testing before deploying browser updates could also remain vulnerable during that period.

Additionally, the limited disclosure of exploit details — while responsible — can hinder defenders who want to create specific detection rules. Chromium’s issue tracker restricts access to the bug report, making it difficult for security teams to understand the exact nature of the spoofing technique. Without that insight, they must assume a worst-case scenario and accelerate patching.

Conclusion

CVE-2025-9867 is a medium-severity bug with a potentially high real-world impact. The Chrome 140 update eliminates a UI spoofing vector that could trick Android users into downloading malware or handing over credentials. The fix is available now through Google Play and will soon propagate to all Chromium-based browsers.

In mobile security, what you see is not always what you get. Patching closes the door on this specific vulnerability, but the attack pattern—exploiting trust—will persist. Update your browsers, reinforce defensive layers, and remind users that when a download prompt appears out of nowhere, hesitation is a virtue.