KEVIntel
Back to KEVs
8.3
CVSS
High

CVE-2025-2783

PUBLISHED

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to...

Exploited in the wild PoC available Remote
Vendor
Google
Product
Chrome
Published
Mar 26, 2025
EPSS
—

Description

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

windows cisa nessus_scanner

CVSS scores

CVSS v3.1 8.3 High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Exploitation status

Exploited in the wild

Recorded 2025-03-27 00:00:00 UTC · Source

Proof of concept available

Recorded 2025-04-06 03:49:01 UTC · Source

SSVC decision points

Exploitation
active
Automatable
No
Technical impact
total

References

Known exploited vulnerability sources

Catalogues that list this CVE as a known exploited vulnerability.

Source Added
CISA Mar 27, 2025

Scanner integrations

Scanner Reference Detected
Nessus https://www.tenable.com/plugins/nessus/233751 Jun 02, 2025

Potential proof of concepts

These PoCs are unverified and could contain malware. Use at your own risk.

Alchemist3dot14/CVE-2025-2783

github · Created 2025-04-06 03:49:01 UTC · 2 stars

Simulated PoC for CVE-2025-2783 — a sandbox escape vulnerability in Chrome's Mojo IPC. Includes phishing delivery, memory fuzzing, IPC simulation, and logging. Safe for red team demos, detection engineering, and educational use.

Timeline

  • CVE ID Reserved

  • CVE Published to Public

  • Added to KEVIntel

  • Proof of Concept Exploit Available

  • Detected by Nessus