Google released an emergency update for the Chrome browser to patch an actively exploited vulnerability that could allow attackers to steal sensitive information. The vulnerability, tracked as CVE-2025-4664, affects the Chrome Loader component, which manages resource requests. The flaw allows attackers to set a referrer-policy in the Link header, causing Chrome to include full URLs with sensitive query parameters. This could lead to the theft of OAuth tokens, session identifiers, and other private data. Users are advised to update their Chrome browsers immediately to versions 136.0.7103.113/.114 for Windows and Mac, and 136.0.7103.113 for Linux.
TPRM report: https://scoringcyber.rankiteo.com/company/google
"id": "goo428051925",
"linkid": "google",
"type": "Vulnerability",
"date": "5/2025",
"severity": "25",
"impact": "",
"explanation": "Attack without any consequences: Attack in which data is not compromised"