CVE-2025-2783 is a high-severity sandbox escape vulnerability in Google Chrome on Windows (prior to version 134.0.6998.177), stemming from an incorrect handle in Mojo. This flaw allows a remote attacker to achieve a sandbox escape via a malicious file, with a CVSS score of 8.3. The attack requires user interaction (UI:R) and has high impact on confidentiality, integrity, and availability (C:H/I:H/A:H). This vulnerability is actively exploited in the wild, with public exploit code available (EDB-52403) and significant community discussion, including reports of APT groups like "Mem3nt0 mori" leveraging it for espionage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 134.0.6998.177CPE matchmatch criteria | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* | ||
>= 134.0.6998.177, < 134.0.6998.177CPE match | cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.4 Bluesky, 0.2 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.6 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.