CVE-2025-25300 Details
Description
smartbanner.js is a customizable smart app banner for iOS and Android. Prior to version 1.14.1, clicking on smartbanner `View` link and navigating to 3rd party page leaves `window.opener` exposed. It may allow hostile third parties to abuse `window.opener`, e.g. by redirection or injection on the original page with smartbanner. `rel="noopener"` is automatically populated to links as of `v1.14.1` which is a recommended upgrade to resolve the vulnerability. Some workarounds are available for those who cannot upgrade. Ensure `View` link is only taking users to App Store or Google Play Store where security is guarded by respective app store security teams. If `View` link is going to a third party page, limit smartbanner.js to be used on iOS that decreases the scope of the vulnerability since as of Safari 12.1, `rel="noopener"` is imposed on all `target="_blank"` links. Version 1.14.1 of smartbanner.js contains a fix for the issue.
A vulnerability in smartbanner.js versions prior to 1.14.1 allows the 'View' link to expose 'window.opener' when navigating to a third-party page. This exposure could be exploited by malicious third parties to manipulate the original page, such as by redirecting or injecting content. The issue arises because the 'View' link can lead to untrusted sites, leaving an opening for potential abuse.
Users are advised to upgrade to smartbanner.js version 1.14.1 or later, which automatically adds 'rel="noopener"' to links, mitigating the vulnerability. For those unable to upgrade, it is recommended to ensure that 'View' links only direct users to the App Store or Google Play Store. If linking to a third-party page, limit the use of smartbanner.js on iOS devices, as Safari 12.1 and later automatically applies 'rel="noopener"' to all 'target="_blank"' links.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Feb 18, 2025CISA-ADP
Assessed Feb 18, 2025References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/ain/smartbanner.js/commit/fce8c31dfe04033d9d005a89694d3e7a60784f89 | [email protected] | Source CodeVendor |
| https://github.com/ain/smartbanner.js/security/advisories/GHSA-9mrq-cjgh-32g2 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-601 | URL Redirection to Untrusted Site ('Open Redirect') | [email protected] |
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| ain smartbanner.js | All versions |
CPE
Remediation
| |
Change History
5 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jun 17, 2026 | CVE Modified | [email protected] |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Apr 29, 2026 | Data Remediation | [email protected] |
| Feb 18, 2025 | CVE Modified | [email protected] |
| Feb 18, 2025 | New CVE Received | [email protected] |