Pierluigi Paganini
May 16, 2025
Google released emergency security updates to address a Chrome browser vulnerability, tracked as CVE-2025-4664, that could lead to full account takeover. The security researcher Vsevolod Kokorin (@slonser_) discovered the vulnerability, which stems from an insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113. A remote attacker could trigger the flaw to leak cross-origin data via a crafted HTML page.
Query parameters can contain sensitive data – for example, in OAuth flows, this might lead to an Account Takeover.
— slonser (@slonser_) May 5, 2025
Developers rarely consider the possibility of stealing query parameters via an image from a 3rd-party resource – which makes this trick surprisingly useful sometimes pic.twitter.com/z2tCiBPTfR
“Google is aware of reports that an exploit for CVE-2025-4664 exists in the wild,” reads the advisory published by Google.
Google patched the flaw in Chrome’s Stable Desktop channel with updates: version 136.0.7103.113 for Windows/Linux and 136.0.7103.114 for macOS.
In March 2025, Google released out-of-band fixes to address another high-severity security vulnerability, tracked as CVE-2025-2783, in Chrome browser for Windows. The flaw was actively exploited in attacks targeting organizations in Russia.
The vulnerability is an incorrect handle provided in unspecified circumstances in Mojo on Windows. Kaspersky researchers Boris Larin (@oct0xor) and Igor Kuznetsov (@2igosha) reported the vulnerability on March 20, 2025.
Mojo is Google’s IPC library for Chromium-based browsers, managing sandboxed processes for secure communication. On Windows, it enhances Chrome’s security, but past vulnerabilities have enabled sandbox escapes and privilege escalation.
Google did not share details about the attacks that exploited this vulnerability or the identity of the threat actors behind them.
“Google is aware of reports that an exploit for CVE-2025-2783 exists in the wild.” reads the advisory published by Google. “The Stable channel has been updated to 134.0.6998.177/.178 for Windows which will roll out over the coming days/weeks. A full list of changes in this build is available in the Log.”
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, Google)
