CVE-2025-0246

What it actually does

When an invalid protocol scheme is supplied, the address bar display can be spoofed on Android, allowing misleading origin information to be presented to the user.

Why it matters to the business

Users may be tricked into interacting with malicious sites they believe are legitimate, increasing risk of phishing or credential theft; the packages appear in many Red Hat Enterprise Linux 9 deployments, amplifying operational exposure.

How an attack unfolds

An attacker crafts a URL containing an invalid protocol scheme and delivers it to an Android user; the browser fails to validate the scheme properly, resulting in a spoofed address bar that conceals the true destination.

How to fix it

Upgrade affected packages to the listed fixed versions: expat (Red Hat:enterprise_linux:9::appstream): fixed in 0:2.5.0-5.el9_7.1, expat-debuginfo (Red Hat:enterprise_linux:9::appstream): fixed in 0:2.5.0-5.el9_7.1, expat-debugsource (Red Hat:enterprise_linux:9::appstream): fixed in 0:2.5.0-5.el9_7.1, expat-devel (Red Hat:enterprise_linux:9::appstream): fixed in 0:2.5.0-5.el9_7.1, and the corresponding baseos variants; verify the update across all installations.

How to confirm the fix worked

Confirm package versions match the fixed releases listed for each expat component on Red Hat Enterprise Linux 9; test address bar behavior with crafted invalid-protocol URLs on Android after update.

Typical attack path

1. Craft URL with invalid protocol scheme
2. Deliver link via phishing email, message, or compromised site
3. User opens link in the vulnerable browser on Android
4. Address bar displays spoofed origin
5. User performs sensitive actions under false assumptions

How to detect it

Review browser logs and network telemetry for connections initiated from links containing unusual or invalid protocol schemes; examine Android device activity for unexpected navigation after receiving external links.

What your security team should do

• Apply the specified expat package updates immediately on all Red Hat Enterprise Linux 9 systems
• Prioritize Android browser deployments given the platform-specific impact
• Monitor for any follow-on updates that also address related address-bar issues
• Review and harden URL handling controls in browser configurations