CVE-2025-55996 PoC — Rakuten Viber Desktop 安全漏洞

Description

Public writeup for CVE-2025-55996 (Viber Desktop HTML Injection)

Readme

# Viber Desktop — HTML Injection (CVE-2025-55996)

**CVE:** CVE-2025-55996  
**Discoverer:** Thaw Khant (Cycbake)  
**Product:** Viber Desktop  
**Affected:** Viber Desktop 25.6.0 (and possibly earlier)  

## Summary
Viber Desktop's deep-link handler (`viber://forward?text=`) can render unsanitized HTML supplied in the `text` parameter inside the message compose/forward interface. While script execution appears restricted by the client, attacker-controlled external resources (e.g., images) can be loaded, enabling user tracking and UI manipulation that may facilitate phishing and privacy leakage.

## Impact
- Remote image/resource loading from attacker-controlled domains (IP/meta leakage).
- Message UI manipulation (misleading text/graphics) enabling social engineering.
- Can be chained with other issues for greater impact.

## Reproduction (redacted)
Reproduction steps are intentionally redacted from this public writeup to avoid mass exploitation. A minimal repro was provided to vendor and MITRE at the time of reporting.

## Mitigation / Recommended fix
- Treat the `text` parameter as plain text; do not render HTML by default.
- Properly escape/encode user-supplied input before rendering in the client.
- Block or proxy external resource loading in forwarded messages (strip remote resource requests or force them to pass via a sanitizing proxy).


## Notes
This public writeup intentionally omits exploit-level details. If you are a vendor or security contact requiring technical details for remediation, please contact the discoverer at the address above.

File Snapshot

Remarks