CVE-2025-13132

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-13132", "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "state": "PUBLISHED", "assignerShortName": "BCNY", "dateReserved": "2025-11-13T15:33:37.631Z", "datePublished": "2025-11-21T17:55:52.758Z", "dateUpdated": "2025-11-21T18:08:38.229Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Dia", "vendor": "The Browser Company of New York", "versions": [{"lessThan": "1.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "datePublic": "2025-11-21T16:39:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)"}], "value": "This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)"}], "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-1021", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "shortName": "BCNY", "dateUpdated": "2025-11-21T17:55:52.758Z"}, "references": [{"url": "https://www.diabrowser.com/security/bulletins#CVE-2025-13132"}], "source": {"discovery": "UNKNOWN"}, "title": "Dia: Increased Spoof Risk; Missing full screen toast", "x_generator": {"engine": "Vulnogram 0.5.0"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-11-21T18:08:15.926290Z", "id": "CVE-2025-13132", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T18:08:38.229Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-13132", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-11-21T18:08:15.926290Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-11-21T18:08:17.741Z"}}], "cna": {"title": "Dia: Increased Spoof Risk; Missing full screen toast", "source": {"discovery": "UNKNOWN"}, "impacts": [{"capecId": "CAPEC-98", "descriptions": [{"lang": "en", "value": "CAPEC-98 Phishing"}]}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "CHANGED", "version": "3.1", "baseScore": 7.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Browser Company of New York", "product": "Dia", "versions": [{"status": "affected", "version": "0", "lessThan": "1.6.0", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2025-11-21T16:39:00.000Z", "references": [{"url": "https://www.diabrowser.com/security/bulletins#CVE-2025-13132"}], "x_generator": {"engine": "Vulnogram 0.5.0"}, "descriptions": [{"lang": "en", "value": "This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)", "supportingMedia": [{"type": "text/html", "value": "This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1021", "description": "CWE-1021 Improper Restriction of Rendered UI Layers or Frames"}]}], "providerMetadata": {"orgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "shortName": "BCNY", "dateUpdated": "2025-11-21T17:55:52.758Z"}}}, "cveMetadata": {"cveId": "CVE-2025-13132", "state": "PUBLISHED", "dateUpdated": "2025-11-21T18:08:38.229Z", "dateReserved": "2025-11-13T15:33:37.631Z", "assignerOrgId": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "datePublished": "2025-11-21T17:55:52.758Z", "assignerShortName": "BCNY"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Dia", "vendor": "The Browser Company of New York", "versions": [{"lessThan": "1.6.0", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)"}, {"lang": "es", "value": "Esta vulnerabilidad permit\u00eda que un sitio entrara en pantalla completa, despu\u00e9s de un clic del usuario, sin que apareciera una notificaci\u00f3n de pantalla completa (toast). Sin esta notificaci\u00f3n, los usuarios podr\u00edan ser potencialmente enga\u00f1ados sobre en qu\u00e9 sitio estaban si un sitio malicioso renderiza una interfaz de usuario falsa (como una barra de direcciones falsa)."}], "id": "CVE-2025-13132", "lastModified": "2026-10-08T10:10:00.227", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.4, "baseSeverity": "HIGH", "confidentialityImpact": "NONE", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 4.0, "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-13132", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-11-21T18:08:15.926290Z", "version": "2.0.3"}}]}, "published": "2025-11-21T18:15:48.813", "references": [{"source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "url": "https://www.diabrowser.com/security/bulletins#CVE-2025-13132"}], "sourceIdentifier": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1021"}], "source": "59469e6c-7ea7-446f-8e43-06aa32c115e8", "type": "Secondary"}]}

{}

{"created": "2025-11-24T09:07:57.150739+00:00", "updated": "2025-11-24T09:07:57.150764+00:00", "vendors": ["the_browser_company", "the_browser_company$PRODUCT$dia"]}