CVE-2025-13132

This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)

CVSS v3 7.4 HIGH

7.4^/10

CVSS v3 : HIGH

Vector :

Exploitability : 2.8 / Impact : 4.0

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.diabrowser.com/security/bulletins#CVE-2025-13132

Configurations

No configuration.

History

08 Oct 2026, 10:10

Type	Values Removed	Values Added
Summary		(es) Esta vulnerabilidad permitía que un sitio entrara en pantalla completa, después de un clic del usuario, sin que apareciera una notificación de pantalla completa (toast). Sin esta notificación, los usuarios podrían ser potencialmente engañados sobre en qué sitio estaban si un sitio malicioso renderiza una interfaz de usuario falsa (como una barra de direcciones falsa).

Information

Published : 2025-11-21 18:15

Updated : 2026-10-08 10:10

NVD link : CVE-2025-13132

Mitre link : CVE-2025-13132

CVE.ORG link : CVE-2025-13132

JSON object : View

Products Affected

No product.

CWE

CWE-1021

Improper Restriction of Rendered UI Layers or Frames

{"id": "CVE-2025-13132", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13132", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T18:08:15.926290Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 4.0, "exploitabilityScore": 2.8}]}, "affected": [{"source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "affectedData": [{"vendor": "The Browser Company of New York", "product": "Dia", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}]}], "published": "2025-11-21T18:15:48.813", "references": [{"url": "https://www.diabrowser.com/security/bulletins#CVE-2025-13132", "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "description": [{"lang": "en", "value": "CWE-1021"}]}], "descriptions": [{"lang": "en", "value": "This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)"}, {"lang": "es", "value": "Esta vulnerabilidad permit\u00eda que un sitio entrara en pantalla completa, despu\u00e9s de un clic del usuario, sin que apareciera una notificaci\u00f3n de pantalla completa (toast). Sin esta notificaci\u00f3n, los usuarios podr\u00edan ser potencialmente enga\u00f1ados sobre en qu\u00e9 sitio estaban si un sitio malicioso renderiza una interfaz de usuario falsa (como una barra de direcciones falsa)."}], "lastModified": "2026-10-08T10:10:00.227", "sourceIdentifier": "59469e6c-7ea7-446f-8e43-06aa32c115e8"}