The vulnerability was discovered by Solidlab security researcher Vsevolod Kokorin and is described as an insufficient policy enforcement in Google Chrome's Loader component that lets remote attackers leak cross-origin data via maliciously crafted HTML pages. Google has released emergency security updates to patch a high-severity vulnerability in the Chrome web browser that could lead to full account takeover following successful exploitation. In March, Google also fixed a high-severity Chrome zero-day bug (CVE-2025-2783) that was abused to deploy malware in espionage attacks targeting Russian government organizations, media outlets, and educational institutions. Google fixed the flaw for users in the Stable Desktop channel, with patched versions (136.0.7103.113 for Windows/Linux and 136.0.7103.114 for macOS) rolling out to users worldwide. Kaspersky researchers who discovered the actively exploited zero-day said that the attackers use CVE-2025-2783 exploits to bypass Chrome sandbox protections and infect targets with malware. While it's unclear if this security flaw has been used in attacks, the company warned that it has a public exploit, which is how it usually hints at active exploitation.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Thu, 15 May 2025 08:29:54 +0000