- Google patched a new chrome error recently
- Now cisa added the vulnerability to Kev that signaled abuse in nature
- Federal agencies have three weeks to update Chrome
The US Cyber Security and Infrastructure Security Agency (CISA) added a new Chrome Bug to its known utilized vulnerabilities (KEV) catalog, signaling abuse in nature, and gave the Federal Civil Civil Executive Branch (FCCEB) a deadline to patch things up.
The error is tracked as CVE-2025-4664. It was recently discovered by security researchers SolidLab and is described as an “insufficient policy enforcement in the Loader in Google Chrome”. At NVD, it was explained that the error allowed remote threat actors to leak transverse origin data via a designed HTML page.
“Inquiry parameters may contain sensitive data -for example, in OAuth streams this can lead to an account takeover. Developers rarely consider the possibility of stealing query parameters via a picture from a 3rd -party resource,” explained researcher Vsevolod Kokorin, which was attributed to detecting the error.
Time to patch
The error was first uncovered on May 5, when Google returned with a patch on May 14. The browser giant did not discuss whether the mistake was exploited in real life attacks, but it said it had a public exploitation (which basically means the same thing).
Now, with CISA that adds the error to KEV, FCEB has agents until June 5 to patch their chrome deposits or stop using the browser completely. The first clean versions are 136.0.7103.113 for Windows/Linux and 136.0.7103.114 for macOS. In many cases, Chrome would automatically insert the update, so just double check which version you are running.
“These types of vulnerabilities are frequent attack vectors for malicious cyclists and pose significant risks to the federal business,” Cisa warned.
In fact, the web browser is one of the most frequently targeted programs as they handle non -procedure data from countless sources around the web. Cyber criminals are always looking for vulnerabilities in the browser code, plugins or poorly secured sites in an attempt to grab login -credentials or other ways to compromise with the wider network.
Via Bleeping computer
