Chrome Users on High Alert: Critical Exploit Active—Immediate Action Required
A major security flaw has surfaced in the latest version of Google Chrome, and attackers are already taking advantage. If you haven’t updated your browser yet, now is the time.
Google has quietly pushed out a critical patch across all major platforms—Windows, macOS, Linux, and Android—addressing a cluster of serious vulnerabilities. The most urgent among them? A zero-day exploit tracked as CVE-2025-4664, which has already been seen in live attacks.
At the core of the issue is a gap in Chrome’s internal “Loader” component, where security checks fail to enforce policy rules properly. This opens a door for cybercriminals to execute malicious code and access data across origins, often without users even realizing it.
Security researcher @slonser_ was the first to flag this threat publicly on May 5, sounding the alarm on X. Their findings suggest the exploit had been in circulation well before Google’s emergency fix was issued.
Google has confirmed the vulnerability is being exploited in real-world scenarios. While specific attack vectors remain undisclosed to prevent further abuse, the underlying flaw enables sandbox escape—one of the more dangerous outcomes in browser-based attacks.
Another serious issue fixed in this update, CVE-2025-4609, affects Chrome’s Mojo IPC framework, a key component in Chrome’s multi-process engine. Improper handling in this layer can result in memory corruption or elevated privileges—tools often used in chained attacks.
The latest secure builds are:
- Windows & macOS: 136.0.7103.113/.114
- Linux: 136.0.7103.113
- Android: 136.0.7103.125 (via Google Play)
Users can manually verify their version by visiting chrome://settings/help.
Behind the scenes, Google’s security infrastructure—powered by tools like AddressSanitizer and fueled by a growing community of external researchers—continues to uncover hidden risks. Over 300 bugs have been found through these systems, reinforcing Chrome’s defenses at scale.
Chrome’s dominance, with over 65% global market share, makes it a magnet for attackers. Google’s vulnerability rewards program remains one of the most lucrative in tech, offering up to $250,000 for discoveries of this caliber.
Bottom line: If Chrome is your browser, don’t wait. Update immediately to shut down active exploits and protect your data.
