Client-side RCE via CSS Injection in Google Web Designer for Windows

tl;dr Tested versions: Google Web Designer 16.3.0.0407 (released April 2025) After my recent discovery of two client-side remote code execution vulnerabilities in Google Web Designer (previously disclosed in my articles earlier this year: CVE-2025-1079 , CVE-2025-4613 ), in April 2025 I've found yet another serious issue in the app. Versions prior to 16.4.0.0711 (released July 29, 2025) had…