Google Fixes High Severity Chrome Flaw with Public Exploit

Google has released emergency security updates to patch a high-severity vulnerability in the Chrome web browser, which could lead to full account takeover following successful exploitation. The company warned that it has a public exploit for the vulnerability, which is a stark indication of active exploitation.

The Vulnerability: A Perfect Storm for Attackers

A security flaw described as insufficient policy enforcement in Google Chrome's Loader component was discovered by Solidlab security researcher Vsevolod Kokorin. This vulnerability allows remote attackers to leak cross-origin data via maliciously crafted HTML pages.

According to Kokorin, the issue lies in Chrome's unique approach of resolving the Link header on subresource requests. In this process, the Link header can set a referrer-policy, which can be used to capture full query parameters. Query parameters often contain sensitive data, such as in OAuth flows, where an attacker could potentially gain access to user accounts.

The Consequences: A Sensitive Data Breach

"Developers rarely consider the possibility of stealing query parameters via an image from a 3rd-party resource," said Kokorin. This oversight can have severe consequences, including full account takeover, making it essential for users to take immediate action.

Google's Response: Emergency Updates

Google fixed the flaw for users in the Stable Desktop channel, with patched versions rolling out to users worldwide. The company stated that the security updates would be available over the coming days and weeks, although they were immediately available when BleepingComputer checked for updates.

Users who don't want to update Chrome manually can also let the browser automatically check for new updates and install them after the next launch. This ensures that all users have access to the latest security patches and can safeguard their accounts from potential exploitation.

A Pattern of Security Awareness

This is not the first time Google has addressed a high-severity Chrome vulnerability in recent times. In March, the company fixed another critical zero-day bug (CVE-2025-2783) that was abused to deploy malware in espionage attacks targeting Russian government organizations, media outlets, and educational institutions.

Staying Ahead of Threats

Last year, Google patched 10 zero-days disclosed during the Pwn2Own hacking competition or exploited in attacks. This demonstrates the company's commitment to staying ahead of emerging threats and ensuring the security of its users' accounts.

Take Action Today

Given the severity of this vulnerability and the availability of a public exploit, it is crucial for all Chrome users to take immediate action. Update your browser with the latest patch, enable automatic updates, or manually check for new updates to ensure that you have access to the latest security patches.