Telegram Group & Telegram Channel
Chrome修复高危漏洞CVE-2025-4664,可被用来绕过MFA实施账户接管

2025年5月,Google发布紧急更新,修复一枚编号为CVE-2025-4664的高危安全漏洞,该漏洞已被黑客在野外利用。该漏洞存在于Chrome 136.0.7103.113 之前的版本,影响Windows、macOS 和 Linux 用户。

该漏洞源于浏览器对HTTP响应中 Link 头部的处理缺陷,攻击者可通过设置不安全的 referrer-policy,诱导浏览器将完整的URL查询参数(如OAuth令牌)泄露给第三方服务器。攻击成功后,黑客可绕过多因素认证(MFA),控制用户账户。

研究者指出,该漏洞特别适用于窃取OAuth认证流程中的敏感参数,具备在SSO等场景中实施账户接管的可能性。

Google建议用户立即将Chrome更新至以下版本以修复漏洞:
• Windows/macOS:136.0.7103.113 / .114
• Linux:136.0.7103.113

该漏洞已在野被利用,建议企业和个人用户高度警惕,尽快完成浏览器更新。

参考链接 [1]



tg-me.com/CN_Privacy/578
Create:
Last Update:

Chrome修复高危漏洞CVE-2025-4664,可被用来绕过MFA实施账户接管

2025年5月,Google发布紧急更新,修复一枚编号为CVE-2025-4664的高危安全漏洞,该漏洞已被黑客在野外利用。该漏洞存在于Chrome 136.0.7103.113 之前的版本,影响Windows、macOS 和 Linux 用户。

该漏洞源于浏览器对HTTP响应中 Link 头部的处理缺陷,攻击者可通过设置不安全的 referrer-policy,诱导浏览器将完整的URL查询参数(如OAuth令牌)泄露给第三方服务器。攻击成功后,黑客可绕过多因素认证(MFA),控制用户账户。

研究者指出,该漏洞特别适用于窃取OAuth认证流程中的敏感参数,具备在SSO等场景中实施账户接管的可能性。

Google建议用户立即将Chrome更新至以下版本以修复漏洞:
• Windows/macOS:136.0.7103.113 / .114
• Linux:136.0.7103.113

该漏洞已在野被利用,建议企业和个人用户高度警惕,尽快完成浏览器更新。

参考链接 [1]

BY 隐私中国 Dark Web Inform


Warning: Undefined variable $i in /var/www/tg-me/post.php on line 283

Share with your friend now:
tg-me.com/CN_Privacy/578

View MORE
Open in Telegram


telegram Telegram | DID YOU KNOW?

Date: |

A project of our size needs at least a few hundred million dollars per year to keep going,” Mr. Durov wrote in his public channel on Telegram late last year. “While doing that, we will remain independent and stay true to our values, redefining how a tech company should operate.

To pay the bills, Mr. Durov is issuing investors $1 billion to $1.5 billion of company debt, with the promise of discounted equity if the company eventually goes public, the people briefed on the plans said. He has also announced plans to start selling ads in public Telegram channels as soon as later this year, as well as offering other premium services for businesses and users.

telegram from us


Telegram 隐私中国 Dark Web Inform
FROM USA