Windows CVE-2025-2783
HIGHCVSS VectorNVD
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Lifecycle Timeline
5DescriptionNVD
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
AnalysisAI
Google Chrome on Windows contains a Mojo IPC handle validation flaw enabling sandbox escape through a malicious file, exploited in targeted attacks against Russian organizations in March 2025.
Technical ContextAI
The vulnerability in Mojo's handle validation on Windows provides an incorrect handle that enables sandbox escape. When a user interacts with a malicious file, the flaw allows the attacker to execute code outside Chrome's sandbox with the user's full privileges.
RemediationAI
Update Chrome immediately. This vulnerability specifically affects Windows. Enable Chrome's enhanced protection mode.
More from same product – last 7 days
{filename} endpoint. The flawed traversal guard only rejects forward slashes and '..' sequences, so absolute Windows pat
Remote code execution in Microsoft Azure Orbital Spatio allows unauthenticated network attackers to upload dangerous fil
Unsafe deserialization in Microsoft Planetary Computer Pro (Geocatalog) lets a remote unauthenticated attacker craft mal
Remote code execution in Microsoft Power Pages allows unauthenticated network attackers to inject and execute operating-
Privilege elevation in Microsoft Azure Resource Manager (ARM) allows remote unauthenticated attackers to bypass authenti
Vendor StatusVendor
Share
External POC / Exploit Code
Leaving vuln.today