{"id":"CVE-2025-4664","published":"2025-05-14T17:41:06Z","modified":"2025-06-05T19:46:02Z","title":"Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak…","vendor":"Google","product":"Chrome","tier":"core","eol":null,"affectedVersions":[{"vendor":"Google","product":"Chrome","versions":[">= 136.0.7103.113, < 136.0.7103.113"]}],"description":{"text":"Insufficient policy enforcement in Loader in Google Chrome prior to 136.0.7103.113 allowed a remote attacker to leak cross-origin data via a crafted HTML page. (Chromium security severity: High)","provenance":"source","from":"CVE.org"},"summary":null,"cvss":{"score":4.3,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N","provenance":"source","from":"CISA ADP Vulnrichment"},"epss":{"score":0.05431,"percentile":0.92694,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2025-05-14","exploitedFirstSeen":"2025-05-14","ransomware":false,"evidence":[{"url":"https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html","date":"2025-05-14"},{"url":"https://www.enisa.europa.eu/sites/default/files/2025-10/ENISA%20Threat%20Landscape%202025.pdf","date":"2025-10-09"},{"url":"https://www.loginsoft.com/reports/annually/vulnerability-intelligence-report-2025","date":"2026-01-20"}],"evidenceTotal":3,"provenance":"source"},"exploited":true,"otx":{"pulseCount":7,"pulses":[{"name":"Top 20 Most Exploited Vulnerabilities of 2025","url":"https://otx.alienvault.com/pulse/693c27f24e17c218bde0b3d9","created":"2025-12-12"},{"name":"Bumblebee Malware Intensifies Corporate Network Attacks via SEO Poisoning, Typosquatting, and DDoS Tactics","url":"https://otx.alienvault.com/pulse/6836e957878cfc54ccf9459b","created":"2025-05-28"},{"name":"Massive NPM Supply Chain Attack: 60+ Malicious Packages Exfiltrate Sensitive Data to Discord","url":"https://otx.alienvault.com/pulse/6832ade5aef18a931f578ac3","created":"2025-05-25"},{"name":"Luna Moth Cybercrime Group Deploys Advanced Social Engineering & Data Heist Tactics Targeting U.S. Organizations – FBI Alert","url":"https://otx.alienvault.com/pulse/683211e08eb103c997dc88a7","created":"2025-05-24"},{"name":"Chrome 0-Day CVE-2025-4664 Exposes Windows, Linux Browser Activity","url":"https://otx.alienvault.com/pulse/683068828c762010b969063c","created":"2025-05-23"},{"name":"Trojanized KeePass Campaign Fuels Black Basta & BlackCat Ransomware Surge: Anatomy of a Supply Chain Attack","url":"https://otx.alienvault.com/pulse/682fe586fba2e1ce0f0159ff","created":"2025-05-23"},{"name":"Critical Otto Kit WordPress Plugin Exploit Raises Major Security Concerns","url":"https://otx.alienvault.com/pulse/682cc3321c1d6f0560324be8","created":"2025-05-20"}],"provenance":"machine"},"cwes":[],"references":[{"url":"https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html","tags":[]},{"url":"https://issues.chromium.org/issues/415810136","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2025-14909","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-14909","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":2,"skipped":1,"earliest":"2025-05-26","earliestUrl":"https://github.com/Leviticus-Triage/ChromSploit-Framework","repos":[{"name":"Leviticus-Triage/ChromSploit-Framework","url":"https://github.com/Leviticus-Triage/ChromSploit-Framework","stars":18,"created":"2025-05-26"},{"name":"amalmurali47/cve-2025-4664","url":"https://github.com/amalmurali47/cve-2025-4664","stars":4,"created":"2025-06-29"}]},"first":{"date":"2025-05-26","source":"PoC-in-GitHub","url":"https://github.com/Leviticus-Triage/ChromSploit-Framework"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2025-05-14","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2025-4664","provenance":"source"},{"date":"2025-05-14","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html","provenance":"source"},{"date":"2025-05-26","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/Leviticus-Triage/ChromSploit-Framework","provenance":"source"}],"speed":{"daysToPublicExploit":12,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":63.6,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 534 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":18.54,"detail":"percentile 0.9269"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"2 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.05,"detail":"7 pulses"},{"name":"CVSS severity","points":3.01,"detail":"base score 4.3"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}