Bug 2416458 (CVE-2025-13132) - CVE-2025-13132 dia: Dia: Spoofing vulnerability due to missing full-screen notification [NEEDINFO]
Summary: CVE-2025-13132 dia: Dia: Spoofing vulnerability due to missing full-screen no...
Keywords:
Status: NEW
Alias: CVE-2025-13132
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
high
high
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2417026 2417027 2417028 2417029
Blocks:
TreeView+ depends on / blocked
 
Reported: 2025-11-21 19:01 UTC by OSIDB Bzimport
Modified: 2026-01-04 02:48 UTC (History)
2 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:
redhat-bugzilla: needinfo? (saroy)

Attachments (Terms of Use)

Description OSIDB Bzimport 2025-11-21 19:01:56 UTC 
This vulnerability allowed a site to enter fullscreen, after a user click, without a full-screen notification (toast) appearing. Without this notification, users could potentially be misled about what site they were on if a malicious site renders a fake UI (like a fake address bar.)
Comment 2 Sandipan Roy 2025-11-25 15:42:51 UTC 
$ newcli -svv dia
epel-8	pkg:rpm/fedora/dia.3-19.el8?arch=src
epel-9	pkg:rpm/fedora/dia.3-19.el9?arch=src
fedora-42	pkg:rpm/fedora/dia.3-29.fc42?arch=src
fedora-43	pkg:rpm/fedora/dia.3-30.fc43?arch=src
Comment 3 Robert Scheck 2026-01-04 02:48:13 UTC 
According to https://www.diabrowser.com/security/bulletins#CVE-2025-13132 the CVE refers to the "Dia Browser" while "GNOME Dia" (https://wiki.gnome.org/Apps/Dia) is actually packaged as "dia".
Note You need to log in before you can comment on or make changes to this bug.