New Chrome Vulnerability Enables Cross-Origin Data Leak via Loader Referrer Policy
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2025-2783 | Sandbox Escape via Mojo Handle Flaw in Google Chrome on Windows (CVE-2025-2783) CVE-2025-2783 is a high-severity sandbox escape in Google Chrome on Windows, caused by an incorrect handle being provided in unspecified circumstances in Mojo, Chrome's inter-process communication layer. It is triggered remotely through a malicious file and requires user interaction; an attacker who has code running inside Chrome's sandboxed renderer can abuse the handle flaw to break out of the Windows sandbox and gain broader access to the host (CVSS scope change with high impact to confidentiality, integrity, and availability). All Google Chrome versions on Windows prior to 134.0.6998.177 are affected, per the vendor fix referenced by CISA. The flaw was added to CISA's Known Exploited Vulnerabilities catalog on 2025-03-27, and related reporting links it to active exploitation in the ForumTroll APT's phishing campaign against Russian scholars using fake eLibrary emails; ransomware use is unknown. No public proof-of-concept is known, and EPSS assigns a 9.2% probability of exploitation within 30 days (95th percentile). Do: Update Google Chrome on Windows to 134.0.6998.177 or later immediately and verify deployed browser versions across endpoints; the flaw is in the CISA KEV catalog, so federal agencies must apply vendor mitigations per BOD 22-01 timelines. Because exploitation is tied to malicious files delivered via phishing (e.g., the ForumTroll fake-eLibrary campaign), prioritize patching for users who open untrusted attachments and links, and hunt for associated phishing emails. | 8.3 | 9% | KEV |
| massbillions of users (Chrome is the world's dominant browser; the Windows-only subset is still likely well over 1 billion) | |
| CVE-2025-4664 | Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High) NVD description · AI analysis pending | 4.3 | 6% |
| — |
Full article342 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananMay 15, 2025Browser Security / Web Security
Google on Wednesday released updates to address four security issues in its Chrome web browser, including one for which it said there exists an exploit in the wild.
The high-severity vulnerability, tracked as CVE-2025-4664 (CVSS score: 4.3), has been characterized as a case of insufficient policy enforcement in a component called Loader.
"Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page," according to a description of the flaw.
The tech giant credited security researcher Vsevolod Kokorin (@slonser_) with detailing the flaw in X on May 5, 2025, adding it's aware "an exploit for CVE-2025-4664 exists in the wild."
"Unlike other browsers, Chrome resolves the Link header on sub-resource requests," Kokorin said in a series of posts on X earlier this month. "The issue is that the Link header can set a referrer-policy. We can specify unsafe-url and capture the full query parameters."
The researcher went on to add that query parameters can contain sensitive data that can lead to a full account takeover and that the query parameter information can be stolen via an image from a third-party resource.
It's not clear if the vulnerability was exploited in a malicious context outside of this proof-of-concept (PoC) demonstration. CVE-2025-4664 is the second vulnerability after CVE-2025-2783 to have come under "active exploitation" in the wild.
To safeguard against potential threats, it's advised to update their Chrome browser to versions 136.0.7103.113/.114 for Windows and Mac, and 136.0.7103.113 for Linux. Users of other Chromium-based browsers such as Microsoft Edge, Brave, Opera, and Vivaldi are also advised to apply the fixes as and when they become available.
Update
The U.S. Cybersecurity and Infrastructure Security Agency (CISA), on Thursday, added CVE-2025-4664 to its Known Exploited Vulnerabilities (KEV) catalog, requiring federal agencies to apply the fixes by June 5, 2025.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2025/05/new-chrome-vulnerability-enables-cross.html