CVE-2025-4664: Exploiting a Chrome 0day to Leak Session Tokens

A while ago, I stumbled across this intriguing tweet from security researcher Vsevolod Kokorin (@slonser_). The three-line snippet was almost boring - create an image element, point the src at a user-controlled URL, drop it into the DOM. In the replies of the tweet, a Google security engineer confirmed it's a 0day. An actively exploited 0day? I had to dig deeper.