Chrome Vulnerability CVE-2025-4664: How to Prevent Cross-Origin Data Leaks Now

1 months ago 高效码农

Chrome Vulnerability CVE-2025-4664: Complete Guide to Mitigating Cross-Origin Data Leaks Image: Google’s emergency update interface for CVE-2025-4664 (Source: Chrome Releases Blog) TL;DR: Key Facts About the Chrome Exploit Critical Vulnerability: CVE-2025-4664 (CVSS 4.3) allows attackers to bypass same-origin policies via Chrome’s Loader component, enabling cross-domain data theft of sensitive URL parameters. Active Exploitation: Google confirmed in-the-wild attacks since May 5, 2025 (Official Advisory). Immediate Fix: Update to Chrome 136.0.7103.113 (Windows/Mac) or 136.0.7103.113 (Linux). Chromium-based browsers (Edge, Brave) require vendor-specific patches. Attack Vector: Malicious HTML pages manipulate Link headers to set referrer-policy: unsafe-url, leaking full URLs through third-party image resources (PoC …