Google has released urgent security updates to addressa high-severity vulnerability in the Chrome browser that is being actively exploited in the wild. The flaw, tracked as CVE-2025-4664, was discovered by Solidlab security researcher Vsevolod Kokorin, and stems from insufficient policy enforcement in Chrome’s Loader component and allows remote attackers to leak cross-origin data through maliciously crafted HTML pages. By manipulating the Link header to set a referrer-policy of unsafe-url, attackers can exfiltrate sensitive query parameters (like as OAuth tokens) via third-party images, potentially leading to full account takeover. While it’s unclear if the vulnerability has been widely abused beyond proof-of-concept (PoC) demonstrations, Google has acknowledged public exploitation reports and urged users to update Chrome immediately. The patched versions (136.0.7103.113 for Windows and Linux, and 136.0.7103.114 for macOS) are now available, with automatic updates rolling out. Users of other Chromium-based browsers like Edge, Brave, Opera, and Vivaldi are also advised to apply patches once available. This marks the second actively exploited Chrome vulnerability in 2025, following CVE-2025-2783, which was linked to espionage attacks targeting Russian organizations. CTIX analysts recommend that all users utilizing Chrome and Chromium-based browsers ensure that their instances are up to date on their browser versions to prevent exploitation.