CVE-2025-2783

Description

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

References

https://www.theregister.com/2025/03/28/google_kaspersky_mozilla/

https://therecord.media/firefox-sandbox-vulnerability-similar-chrome-zero-day

https://thehackernews.com/2025/03/mozilla-patches-critical-firefox-bug.html

https://www.cisa.gov/news-events/alerts/2025/03/27/cisa-adds-one-known-exploited-vulnerability-catalog

https://www.bleepingcomputer.com/news/security/mozilla-warns-windows-users-of-critical-firefox-sandbox-escape-flaw/

https://therecord.media/russian-media-academia-targeted-in-espionage-campaign

https://www.helpnetsecurity.com/2025/03/26/google-fixes-exploited-chrome-sandbox-bypass-zero-day-cve-2025-2783/

https://www.darkreading.com/cyberattacks-data-breaches/google-patches-chrome-zero-day-exploited-apt

https://www.bleepingcomputer.com/news/security/google-fixes-chrome-zero-day-exploited-in-espionage-campaign/

https://thehackernews.com/2025/03/zero-day-alert-google-releases-chrome.html

https://www.securityweek.com/google-patches-chrome-sandbox-escape-zero-day-caught-by-kaspersky/

https://securelist.com/operation-forumtroll/115989/

https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html

https://issues.chromium.org/issues/405143032

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3