CVE-2025-4609

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially…

Critical · published August 22, 2025

CVSS v3.1
9.6
EPSS
0%
Percentile
31.9
In the wild
Unconfirmed
What it is

🚨 A subtle flaw in Google Chrome could let a crafty attacker escape their sandbox with just the right file—talk about a game changer! 🔥 Think of this like a magician who manages to slip out of a sealed box meant to keep them contained. If they can exploit the right misdirection, they could waltz out into the audience, causing chaos! An attacker could potentially break out of the Chrome sandbox, gaining unauthorized access to sensitive information or executing malicious code on your system. This could lead to full control over your device, allowing them to steal data or spread malware—absolutely devastating!

Put simply

Think of this like a magician who manages to slip out of a sealed box meant to keep them contained. If they can exploit the right misdirection, they could waltz out into the audience, causing chaos! This vulnerability in Mojo within Chrome allows for a sandbox escape due to an incorrect handle provided in certain circumstances, meaning an attacker can leverage malicious files to bypass protections.

What to do

An attacker could potentially break out of the Chrome sandbox, gaining unauthorized access to sensitive information or executing malicious code on your system. This could lead to full control over your device, allowing them to steal data or spread malware—absolutely devastating! Update Google Chrome to version 136.0.7103.113 or later immediately. Regularly check for updates to ensure other vulnerabilities are patched. Stay vigilant and consider restricting untrusted file types if you manage a larger environment. You've got this! Keep your browser updated, and you'll stay one step ahead of the bad guys. 🛡️

The record
Technical detail
CVSS v3.1
9.6 · CRITICAL
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00390 · 31.9th percentile
Published
2025-08-22T21:05Z
EPSS history
Timeline
  • 22 AUG 21:05Z
    Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially…
    cvelistv5