Google patches Chrome vulnerability used for account takeover and MFA bypass

Chrome users are advised to update their browser immediately to fix a critical vulnerability that is being exploited to launch account takeover attacks.

In some environments, this could even give attackers the ability to bypass multi-factor authentication (MFA).

The recently-reported vulnerability, one of four fixed in a Wednesday update, is tracked as CVE-2025-4664 and affects all versions of Chrome prior to version 136.0.7103.113.

Google’s advisory says very little about the flaw beyond stating, “Google is aware of reports that an exploit for CVE-2025-4664 exists in the wild.”

That explains the urgency of the fix being issued outside the normal update cycle, an ‘emergency patch’ if you like. These come along occasionally, and given the daily use of browsers, are always a priority for users and admins alike.