Client-side RCE via Symlink Following in Google Web Designer for macOS/Linux: CVE-2025-1079

tl;dr Tested version: Google Web Designer 16.1.0.0530 (released cca. June 2024) This issue is tracked as CVE-2025-1079 , and has been fixed in version 16.2.0.0128 , released February 28, 2025 . In November 2024 I’ve discovered a vulnerability in Google Web Designer that exposed its users on macOS and Linux to the possibility of client-side remote code execution via improper symbolic link…