Charles Esther
A newly discovered zero-day vulnerability in Google Chrome and Chromium browsers is raising serious alarms for billions of users worldwide.
Tracked as CVE-2025-4664, this flaw exploits Chrome’s unique handling of the referrer-policy directive, enabling silent data siphoning across origins without any user interaction.
Researchers from cybersecurity firm Wazuh have warned that this vulnerability allows malicious sites to leak sensitive data such as OAuth tokens and session identifiers by abusing the way Chrome processes sub-resource requests.
How the Vulnerability Works
The problem lies within the Loader component of Chrome and Chromium browsers, specifically in how these browsers handle the Link HTTP header for sub-resources like images or scripts.
Unlike most other mainstream browsers, Chrome honors the referrer-policy directive even on sub-resources.
This behavior means an attacker can inject a lax policy—such as unsafe-url—causing full URLs, including sensitive data, to be sent to third-party domains.
Such leaking bypasses traditional browser security measures and undermines common web security assumptions.
Demonstration and Detection
In controlled lab environments using Wazuh OVA 4.12.0, researchers showed how Windows 11 and Debian 11 endpoints could be scanned to detect vulnerable Chrome or Chromium versions.
Wazuh’s Vulnerability Detection module integrates Cyber Threat Intelligence (CTI) data to monitor browser versions and raise alerts when a vulnerable package is present.
Users and administrators can quickly isolate affected systems by querying CVE-2025-4664 in the Wazuh dashboard, which also tracks mitigation status.
Patch Status and Recommendations
Google has issued an emergency patch to fix the flaw for Windows and Gentoo Linux users, urging immediate browser updates.
However, Debian 11 Chromium users remain at risk, with all versions up to 120.0.6099.224 vulnerable and no patched version available yet.
For now, Debian users are advised to uninstall Chromium until an update is released.
Broader Security Implications
While patching vulnerable browsers is critical, relying solely on browser updates leaves users exposed to gaps in protection.
Experts recommend combining patching with endpoint protection platforms, antivirus, and malware defenses to build multiple layers of security.
These additional tools provide real-time detection and containment capabilities that can stop exploit attempts beyond browser vulnerabilities.
Conclusion
CVE-2025-4664 highlights how even trusted browsers like Google Chrome can harbor catastrophic zero-day vulnerabilities.
Users and organizations must remain vigilant and proactive in updating software and strengthening endpoint security to defend against silent data siphoning risks.
The incident serves as a reminder that layered security approaches remain vital in an era of rapidly evolving cyber threats.
