CVE-2025-2783KEV · OVERDUE

Google Chromium Mojo Sandbox Escape Vulnerability

High · published March 26, 2025

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.3. It is confirmed in active exploitation. It sits in the 95.3th percentile for exploit probability.

555
days past CISA
deadline
CVSS v3.1
8.3
EPSS
9%
Percentile
95.3
In the wild
Confirmed
What it is

🚨 A remote attacker can exploit a sandbox escape in Google Chrome, potentially allowing them to run wild on your Windows system! 🔥 Think of the sandbox as a kids' play area where they can safely have fun. This vulnerability is like a sneaky adult who finds a way to lift the fence and let themselves in, causing chaos among the children! If exploited, an attacker could break free from the browser's sandbox and gain access to sensitive information or even control the entire system. This could lead to severe data breaches and the complete compromise of your machine. It's absolutely devastating!

Put simply

Think of the sandbox as a kids' play area where they can safely have fun. This vulnerability is like a sneaky adult who finds a way to lift the fence and let themselves in, causing chaos among the children! This vulnerability in Mojo allows a remote attacker to bypass the application's sandboxing mechanism using a malicious file, which could lead to unauthorized actions on the system.

What to do

If exploited, an attacker could break free from the browser's sandbox and gain access to sensitive information or even control the entire system. This could lead to severe data breaches and the complete compromise of your machine. It's absolutely devastating! Upgrade Google Chrome to version 134.0.6998.177 or later immediately. Regularly check for updates and ensure that your browser is always running the latest version. Don't forget to enable security features that can help mitigate risks! You've got this! By taking these steps, you'll be well on your way to keeping your system secure! 🛡️

The record
Technical detail
CVSS v3.1
8.3 · HIGH
Vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.09238 · 95.3th percentile
Published
2025-03-26T16:07Z
KEV added
2025-03-27 · due 2025-04-17
EPSS history
Timeline
  • 27 MAR 00:00Z
    Added to CISA KEV — remediate by Apr 17
    kev
  • 26 MAR 16:07Z
    Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a…
    cvelistv5