Client-side RCE via Improper URL Parsing in Google Web Designer for Windows: CVE-2025-4613

tl;dr Tested versions: Google Web Designer 16.1.0.0530 (released cca. June 2024) and 16.2.0.0128 (released February 28, 2025) This issue is tracked as CVE-2025-4613 , and has been fixed in version 16.3.0.0407 , released cca. April 19, 2025. Shortly after finding my first RCE on the app , in February 2025 I’ve discovered a vulnerability in Google Web Designer that exposed its users to another…