Vulnerability · Published Jun 12, 2025 · Assigned by Google
CVE-2025-4613Client side RCE in Google Web Designer App
High 7.1
In plain English
A high-severity improper input validation in Web Designer App from Google. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.6% (higher than 49% of all known vulnerabilities).
Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.6%top 50.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Web Designer App | 0 – before 16.3.0.0407 |
Weakness: CWE-20 · Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:L/UI:A/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/S:N/AU:N/R:U/V:D/RE:L