CVE-2025-2783: high-severity vulnerability in Google Chrome
Published · Updated
Prioritize patching. It under exploitation confirmed by CISA and has a public proof of concept.
Official vendor statements in CSAF/VEX format: whether their product is affected, already fixed, or ruled out — and why. These are the vendor's assertions, not Vexday's judgment.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
A flaw in Chrome's Mojo messaging system on Windows allows an attacker to bypass the browser's sandbox protection by tricking Chrome into processing a specially crafted file, potentially gaining full access to the infected computer.
An incorrect handle management vulnerability in Mojo (Chrome's inter-process communication framework) on Windows permits remote code execution outside the sandbox context. The attack vector involves delivery of a malicious file that exploits improper handle validation; successful exploitation requires user interaction to open the file and results in complete sandbox escape with system-level privileges.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.