Chrome fixed CVE-2025-4664, a High-severity vulnerability in its Loader component, in May 2025. Google said it was aware that knowledge of the vulnerability existed in the wild. To protect your browser, open Help > About Google Chrome, install any offered update, and relaunch Chrome. The versions that first included the fix—136.0.7103.113/.114 on Windows and Mac and 136.0.7103.113 on Linux—are historical, not current-version recommendations.
What CVE-2025-4664 could expose
The flaw involved Chrome’s Loader component and could allow cross-origin data to leak when a user visited a crafted page. Google’s release note confirms the vulnerability and its severity, but does not detail the exploit mechanics.
According to researcher Vsevolod Kokorin, as quoted by The Hacker News, Chrome’s handling of a Link header on sub-resource requests could let the header set a referrer-policy. Kokorin said an attacker could specify unsafe-url and capture full query parameters. In the reported scenario, a request for a third-party resource, such as an image, could expose sensitive values carried in a URL. This is the researcher’s explanation as reported by The Hacker News, not a mechanism described in Google’s advisory.
What Google confirmed about severity and exploitation
Google’s May 14, 2025 Stable Channel update rated CVE-2025-4664 High and said, “Google is aware that knowledge of CVE-2025-4664 exists in the wild.” That wording supports reporting vendor awareness of in-the-wild exploitation; Google’s public note does not name an attacker, campaign, or victims.
#1 Best Overall
- Attention-grabbing design meets the latest evolution of the Google Pixel Camera on the new Google Pixel 11 Pro; Gemini Intelligence helps manage details so you can live in the moment[1]; and the phone is available in two sizes
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan: Works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers[2]
- Stay informed without looking at your screen: When your phone is face down, Pixel HiLight gently alerts you with subtle glowing lights when your favorite contacts are calling or you’re talking with Gemini; exclusive to Google Pixel 11 Pro phones
- Magic Capture catches the moment as you live it: With just one tap, Pixel 11 Pro captures video and photos, and automatically edits, crops, and unblurs a curated collection, ready to share – and you get the memory of how it felt to be in the moment
- Two new cameras for more brilliant photos: A larger telephoto sensor captures 30% more light for clear, beautiful photos and videos, even in the dark[3]; Pixel’s longest zoom ever helps you capture details from impressive distances[4]
The Hacker News separately reported a CVSS score of 4.3. That numeric score and Google’s High severity label are different attributed descriptions; Google’s release note does not include the score. The Hacker News also said it was unclear whether the flaw had been used maliciously beyond the proof-of-concept context described. There is no confirmed victim count or account-takeover count in the cited reporting.
Which Chrome versions first included the fix
Google listed the following fixed desktop releases in its May 14, 2025 update:
Rank #2
- Google Pixel 10a is a durable, everyday phone with more[1]; snap brilliant photography on a simple, powerful camera, get 30+ hours out of a full charge[2], and do more with helpful AI like Gemini[3]
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan; it works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Pixel 10a is sleek and durable, with a super smooth finish, scratch-resistant Corning Gorilla Glass 7i display, and IP68 water and dust protection[4]
- The Actua display with 3,000-nit peak brightness shows up clear as day, even in direct sunlight[5]
- Plan, create, and get more done with help from Gemini, your built-in AI assistant[3]; have it screen spam calls while you focus[6]; chat with Gemini to brainstorm your meal plan[7], or bring your ideas to life with Nano Banana[8]
| Platform | First fixed release listed by Google |
|---|---|
| Windows | 136.0.7103.113 or 136.0.7103.114 |
| Mac | 136.0.7103.113 or 136.0.7103.114 |
| Linux | 136.0.7103.113 |
Google said the rollout would occur over the coming days or weeks. The University of Michigan’s May 15, 2025 alert described versions before 136.0.7103.113 as affected. These version numbers identify the original fix; they are not a recommendation to remain on Chrome 136. Use Chrome’s built-in updater and install the current supported release offered for your system.
How to update Chrome and relaunch
- Open Chrome’s three-dot menu and choose Help > About Google Chrome. You can also open Chrome’s About page directly from the menu.
- Wait while Chrome checks for updates. If an update is offered, let it download and install.
- Select Relaunch when prompted so Chrome can complete the update. Save any work in open tabs first.
- Return to the About page and confirm Chrome reports that it is up to date.
The University of Michigan notes that Chrome normally updates in the background, but advises users to verify the update and relaunch. Google’s release note says some vulnerability details and bug-report links may remain restricted until most users have updated.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →What the public information does not establish
Google’s advisory does not describe the precise Loader code change that fixed CVE-2025-4664. The available reporting also does not establish a named threat actor, a specific victim, or a confirmed account takeover. The Hacker News reported that CISA added the CVE to its Known Exploited Vulnerabilities catalog and gave a June 5, 2025 federal remediation deadline; that catalog detail is attributed here to the news report, not independently confirmed from a CISA page.
Quick Recap
Best Value
- Google Pixel 7 is powered by Google Tensor G2; it’s faster, more efficient, and more secure, with the best photo and video quality yet on Pixel[1].Other camera description:Front,Rear.Bluetooth Version 5.2 with dual antennas for enhanced quality and connection.
- Unlocked Android 5G phone gives you the flexibility to change carriers and choose your own data plan[2]; works with Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Pixel’s Adaptive Battery can last over 24 hours; when Extreme Battery Saver is turned on, it can last up to 72 hours[3]
- The 6.3-inch Pixel 7 display is super sharp, with rich, vivid colors; it’s fast and responsive for smoother gaming, scrolling, and moving between apps[4]
- Google Pixel 7 has wide and ultrawide lenses with up to 8x Super Res Zoom[5]; and Cinematic Blur brings more drama to your videos
Rank #4
- Google Pixel 10 Pro is the ultimate Pixel experience, featuring advanced AI with Gemini, unbelievable camera quality, impeccable design in two sizes, and the next-gen Google Tensor G5 chip[1]
- Unlocked Android phone gives you the flexibility to change carriers and choose your own data plan[2]; it works - Google Fi, Verizon, T-Mobile, AT&T, and other major carriers
- Get a head start on syncing your data before it even arrives: After you purchase your new Pixel, look for an email that explains how to transfer your photos, videos, passwords, and more in just a few quick steps[11]
- Pixel’s pro camera system makes everything look amazing, even in low light; capture more of the scene with advanced Google AI models, and bring out incredible details with 100x Pro Res Zoom, stunning 50 MP images, and super steady videos in 8K[10]
- Pixel 10 Pro is built with durable aluminum and Corning Gorilla Glass Victus 2 for scratch and drop resistance; the 6.3-inch Super Actua display with 3,300-nit peak brightness is easy on the eyes, even in direct sunlight[3,13,18]
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
