Google

Security Advisory

Zero-Day Threat in Chrome’s Loader Component (CVE-2025-4664) – CISA Flags Urgent Risk 

Summary : A zero-day vulnerability (CVE-2025-4664) in Google Chrome’s Loader component has been actively exploited in the wild.

OEM Google 
Severity Medium 
CVSS Score 4.3 
CVEs CVE-2025-4664 
Actively Exploited Yes 
Exploited in Wild Yes 
Advisory Version 1.0 

Overview 

This flaw allows attackers to bypass security policies, leak cross-origin data, and potentially execute unauthorized code. CISA has added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, urging immediate patching. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
​Insufficient Policy Enforcement vulnerability  CVE-2025-4664 Google Chrome  Medium  136.0.7103.113/.114 (Win/Mac),  136.0.7103.113 (Linux) 

Technical Summary 

CVE-2025-4664 is a zero-day vulnerability found in the Chrome Loader component due to insufficient policy enforcement.

It enables remote attackers to bypass browser security controls using crafted HTML content, possibly leaking cross-origin data or achieving sandbox escape. The bug has been actively exploited in the wild.

A second high-severity flaw, CVE-2025-4609, was also addressed in this update, involving an incorrect handle in the Mojo IPC layer, which can lead to memory corruption or privilege escalation. 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-4664  Chrome (Windows, Mac, Linux) Insufficient policy enforcement in Loader enables cross-origin data leaks via crafted HTML.  Data leakage, sandbox escape, potential code execution 

Remediation: 

  • Update Chrome: Google has released security updates to address these vulnerabilities. Users and administrators must apply the latest Chrome versions: 
  • Windows/macOS: Chrome 136.0.7103.113 /136.0.7103.114 or later 
  • Linux: Chrome 136.0.7103.113 or later 

Conclusion: 
The active exploitation of CVE-2025-4664 highlights the urgent need for rapid security response and patch management. With acknowledgment from CISA and public disclosure by @slonser_, this zero-day poses a real and present threat to users of Chrome and other Chromium-based browsers.

Organizations should take immediate action to patch affected systems and monitor for signs of compromise.

Regular browser updates and proactive vulnerability management are essential to mitigating such critical security risks. 

References: 

Security Advisory

Update Google Chrome to Fix Critical Remote Code Execution Vulnerability in Lens 

OEM Google Chrome 
Severity High 
CVSS 8.8 
CVEs CVE-2025-2476 
Exploited in Wild No 
Patch/Remediation Available Yes 
Advisory Version 1.0 

Overview 

Google Chrome’s Lens component has been found to have a critical use-after-free vulnerability (CVE-2025-2476) that impacts Linux, Mac, and Windows. 

This vulnerability might compromise user systems by enabling remote attackers to run arbitrary code.  To lessen the danger, Google has issued security patches. 

Vulnerability Name CVE ID Product Affected Severity Fixed Version 
 Use after free Vulnerability  CVE-2025-2476  Google Chrome  High  134.0.6998.117/.118 

Technical Summary 

The vulnerability exists due to a use-after-free (UAF) condition in Chrome’s Lens component. This occurs when a program continues to use memory after it has been freed, potentially leading to arbitrary code execution or system compromise. Attackers can exploit this flaw using specially crafted HTML pages that trigger heap corruption. 

CVE ID System Affected Vulnerability Details Impact 
  CVE-2025-2476   Windows, Mac, Linux   Use-after-free vulnerability in Chrome’s Lens component, leading to heap corruption and potential arbitrary code execution.  Remote code execution 

Remediation: 

  1. Open Google Chrome. 
  1. Click the three-dot menu in the upper-right corner. 
  1. Navigate to Help > About Google Chrome. 
  1. Allow Chrome to automatically check for and install the latest update. 
  1. Restart the browser to complete the update process. 
  • The update will roll out over the coming days and weeks, However, due to the critical nature of this security issue, users should not rely on automatic updates and should manually confirm they are running the latest version. 

Google has restricted detailed vulnerability information until a majority of users have applied the fix to prevent potential exploitation. 

A vulnerability has been discovered in Google Chrome, which could allow for arbitrary code execution. Successful exploitation of this vulnerability could allow for arbitrary code execution in the context of the logged-on user.

Depending on the privileges associated with the user an attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

Users whose accounts are configured to have fewer user rights on the system could be less impacted than those who operate with administrative user rights.

Manage default accounts on enterprise assets and software, such as root, administrator, and other pre-configured vendor accounts.

Threat Intelligence :

There are currently no reports of the vulnerability being exploited in the wild.

Conclusion: 

The possibility of remote code execution makes CVE-2025-2476 a serious security risk. It is highly recommended that users upgrade their Chrome browsers ASAP.

This vulnerability emphasizes how crucial it is to keep up with security patches on time and to be vigilant about new online threats. 

References: 

Image 

Scroll to top