Google Issues Emergency Chrome Update to Patch an Actively Exploited Vulnerability

• Google released an emergency fix for an actively exploited flaw in its Chrome browsers.
• The vulnerability could allow an attacker to exfiltrate data that users share with other websites.
• The issue lies in the Chrome Loader component, which manages requests to fetch and display images, scripts, or stylesheets.

Google has released an emergency update for its Chrome browser to patch a critical vulnerability identified as CVE-2025-4664, which is presently being exploited by malicious actors. 

Highlighting the seriousness of this exploit, the Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild. 

This flaw is located within the Chrome Loader component, a critical part of the browser responsible for handling resource requests whenever a website is accessed. 

The uncovered vulnerability is particularly dangerous as it allows attackers to circumvent the same-origin policy by incorrectly applying security policies to Link headers. 

This misconfiguration grants malicious actors the ability to set a referrer-policy in the Link header, resulting in Chrome inadvertently transmitting full URLs containing sensitive query parameters, such as OAuth tokens and session identifiers, to malevolent websites. 

This breach of privacy could lead to attackers gaining access to sensitive information, initiating potential account takeovers or unauthorized access to various online services.

To safeguard against this risk, it is recommended for users to promptly update their Google Chrome browsers to versions 136.0.7103.113/.114 for Windows and Mac, and 136.0.7103.113 for Linux. 

While Chrome typically updates automatically, users who leave their browsers open for long durations or those experiencing extension-related issues should consider manually updating by navigating to Settings > About Chrome. 

This process will enable the download of available updates, following which the browser will prompt a restart to finalize the installation.