Google has launched emergency security updates to patch a high-severity vulnerability within the Chrome internet browser that might result in full account takeover following profitable exploitation.
Whereas it is unclear if this security flaw has been utilized in assaults, the corporate warned that it has a public exploit, which is the way it often hints at lively exploitation.
“Google is conscious of studies that an exploit for CVE-2025-4664 exists within the wild,” Google stated in a Wednesday security advisory.
The vulnerability was found by Solidlab security researcher Vsevolod Kokorin and is described as an inadequate coverage enforcement in Google Chrome’s Loader part that lets distant attackers leak cross-origin knowledge through maliciously crafted HTML pages.
“You most likely know that in contrast to different browsers, Chrome resolves the Hyperlink header on subresource requests. However what’s the issue? The problem is that the Hyperlink header can set a referrer-policy. We will specify unsafe-url and seize the total question parameters,” Kokorin defined.
“Question parameters can comprise delicate knowledge – for instance, in OAuth flows, this may result in an Account Takeover. Builders not often think about the potential for stealing question parameters through a picture from a Third-party useful resource.”
Google mounted the flaw for customers within the Steady Desktop channel, with patched variations (136.0.7103.113 for Home windows/Linux and 136.0.7103.114 for macOS) rolling out to customers worldwide.
Though the corporate says the security updates will roll out over the approaching days and weeks, they had been instantly obtainable when BleepingComputer checked for updates.
Customers who do not need to replace Chrome manually may also let the browser mechanically examine for brand spanking new updates and set up them after the subsequent launch.
In March, Google additionally mounted a high-severity Chrome zero-day bug (CVE-2025-2783) that was abused to deploy malware in espionage assaults concentrating on Russian authorities organizations, media retailers, and academic establishments.
Kaspersky researchers who found the actively exploited zero-day stated that the attackers use CVE-2025-2783 exploits to bypass Chrome sandbox protections and infect targets with malware.
Final 12 months, Google patched 10 zero-days disclosed in the course of the Pwn2Own hacking competitors or exploited in assaults.
Primarily based on an evaluation of 14M malicious actions, uncover the highest 10 MITRE ATT&CK methods behind 93% of assaults and how you can defend in opposition to them.
