Read the docs
TI-2025-04125 Aliases CVE-2025-4613GHSA-vwv7-36jv-h55v

Client side RCE in Google Web Designer App

Priority HIGH 66CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
High
Attack requirements
Present
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA.

Summary

Path traversal in Google Web Designer's template handling versions prior to 16.3.0.0407 on Windows allows attacker to achieve remote code execution by tricking users into downloading a malicious ad template

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00606 49th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Web Designer App (Google): 16.3.0.0407

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
GoogleWeb Designer Appbefore 16.3.0.040716.3.0.0407Patch availableCNA
  • Web Designer App VendorGoogle Affected before 16.3.0.0407 Fixed in 16.3.0.0407 Patch available CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:google:web_designer:*:*:*:*:*:*:*:*before 16.3.0.0407VulnerableGoogle
cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*not specified by NVDRunning onMicrosoft
  • cpe:2.3:a:google:web_designer:*:*:*:*:*:*:*:* Versions before 16.3.0.0407 Vulnerable ·Google
  • cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Microsoft

Remediation

  • Fix · CNA Web Designer App (Google) Fixed in 16.3.0.0407

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-4613
  2. 2026-10-03 Alias added: GHSA-vwv7-36jv-h55v

References

Exploit 1

  • TI-2026-02786 Zip Slip leading to Arbitrary File Write and Privilege Escalation in Google Web Designer CVSS 4.0HIGH 8.4
  • TI-2025-00917 RCE In Google Web Designer CVSS 3.1HIGH 7.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences