CISA Flags Critical Chromium Security Flaw—Immediate Action Advised
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially listed CVE-2025-4664 in its Known Exploited Vulnerabilities (KEV) catalog, signaling that attackers are currently leveraging this flaw in active campaigns.
What’s at Risk?
A critical weakness has been uncovered in the Loader component of Google Chromium—the engine powering major browsers like Chrome, Edge, and Opera. Due to inadequate policy enforcement, malicious actors can exploit this bug to siphon sensitive data across different website origins using specially crafted HTML pages.
This vulnerability affects a wide swath of internet users globally and is already being exploited in real-world attacks, increasing urgency for immediate defensive action.
Affected Versions & Immediate Fixes
Google has released patched versions to neutralize the threat:
- Windows & macOS: Chrome 136.0.7103.113 or .114
- Linux: Chrome 136.0.7103.113
All users and system administrators are strongly urged to deploy these updates without delay.
No Patch? No Problem—Yet
If you’re unable to update right away, CISA advises temporarily halting use of affected browsers and following the cloud security mitigation steps in Binding Operational Directive 22-01 (BOD 22-01). Organizations have until June 5, 2025 to complete mitigation.
Under the Hood: What Makes CVE-2025-4664 Dangerous?
- Type: Insufficient policy enforcement (linked to CWE-346)
- Component: Chromium’s Loader
- Attack Vector: Crafted HTML to exfiltrate cross-origin data
- Deeper Root: An incorrect handle assignment within Chromium’s Mojo IPC layer, which could open doors to sandbox escapes or even remote code execution.
Bottom Line:
CVE-2025-4664 is not a theoretical concern—it’s actively exploited. Organizations and users must treat this as a high-priority incident and respond swiftly with updates or alternative mitigations.
Vulnerability Overview: CVE-2025-4664
- Identifier: CVE-2025-4664
- Severity Level: High
- Issue Summary: A flaw in Chromium’s Loader component results in inadequate policy enforcement, allowing unauthorized cross-origin data exposure.
- Impacted Module: Chromium Loader, specifically within the Mojo Inter-Process Communication (IPC) layer
- Exploitation Status: Actively exploited in live environments; confirmed by Google
- CWE Reference: CWE-346 – Insufficient Policy Enforcement
- Discovery: Initially disclosed by security researcher @slonser_ via X (formerly Twitter), with corroborating details shared by researcher Micky on April 22, 2025
Critical Alert: Chromium Flaw Opens Door to Cross-Origin Data Exposure—Act Now
A newly disclosed zero-day vulnerability, CVE-2025-4664, presents a serious security concern with the potential to breach browser isolation boundaries. Exploited in the wild before any fix was issued, the flaw allows crafted websites to exfiltrate data from other domains—a direct threat to user privacy and web security.
Though no direct ties to ransomware have surfaced yet, the exploit’s behavior suggests it could be leveraged for privilege escalation, sandbox escapes, or memory corruption, making it a high-value target for threat actors.
🚨 Why This Matters
- Attackers are already using this vulnerability.
- It affects all major Chromium-based browsers, including Chrome, Edge, and Opera.
- The longer the delay in response, the greater the exposure—especially in enterprise environments with distributed endpoints.
🛠 Fix Released—Take These Actions Now
On May 15, 2025, Google pushed a critical security update to its Stable Channel, covering all major desktop platforms:
- Windows & macOS: Version 136.0.7103.113 or .114
- Linux: Version 136.0.7103.113
To fully neutralize the threat, users and IT administrators must upgrade immediately. If updates can’t be applied, halt browser usage on vulnerable systems and follow CISA’s BOD 22-01 cloud service guidelines.
Mitigation deadline: June 5, 2025
Organizations have ~3 weeks from the KEV catalog listing to act.
✅ What You Should Do Today
- Patch Chrome to the latest version across all endpoints.
- Enable automated update policies to avoid future delays.
- Audit for any signs of compromise linked to cross-origin access anomalies.
- Implement centralized monitoring to detect browser-based threats.
- Disseminate this advisory internally to technical teams and end users.
🔍 Stay Ahead of Emerging Threats
Monitor these sources for real-time updates and best practices:
Proactive patching and user awareness are key defenses. In an age of increasingly fast-moving threats, visibility and speed are your greatest allies.
