CVE-2025-2783: Google Chromium Mojo Sandbox Escape Vulnerability

What it is

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Exploitation evidence

First exploit evidence seen: 2025-03-27 (earliest date across the sources below).

Exploited in the wild

• CISA KEV: listed since 2025-03-27. Source

Public exploit code

Exploit-DB

• EDB-52403: Microsoft Edge Renderer Process (Mojo IPC) 134.0.6998.177 - Sandbox Escape (2025-08-11)

GitHub proof-of-concept repositories

5 public repositories from 5 accounts, first seen 2025-04-06. Most starred: Alchemist3dot14/CVE-2025-2783 (33 stars), view repository.

Verify before running: public PoCs can be malicious. Read the code and only run it in an isolated lab. A PoC means exploit code is public, not that this CVE is exploited in the wild.

Sources: CISA KEV · Exploit-DB (OffSec) · nomi-sec/PoC-in-GitHub.

How to fix it

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. (source: CISA KEV)

Fixed versions

• google chrome: upgrade to 134.0.6998.177 or later

Derived from the NVD CPE configuration (versionEndExcluding / versionEndIncluding). Always confirm with the vendor advisory.

Vendor advisories and patches

• https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html (CISA KEV notes)

MITRE ATT&CK mitigations for this chain

• M1050 Exploit Protection (for T1203) : Security applications that look for behavior used during exploitation such as Windows Defender Exploit Guard (WDEG) and the Enhanced Mitigation Experience Toolkit (EMET) can be used to mitigate some exploitation behavior. Control flow integrity checking is another way to potentially identify and stop a software exploi
• M1051 Update Software (for T1203, T1548) : Perform regular software updates to mitigate exploitation risk. Keeping software up-to-date with the latest security patches helps prevent adversaries from exploiting known vulnerabilities in client software, reducing the risk of successful attacks.
• M1048 Application Isolation and Sandboxing (for T1203) : Browser sandboxes can be used to mitigate some of the impact of exploitation, but sandbox escapes may still exist. Other types of virtualization and application microsegmentation may also mitigate the impact of client-side exploitation. Risks of additional exploits and weaknesses in those systems may still exist.
• M1038 Execution Prevention (for T1548) : System settings can prevent applications from running that haven't been downloaded from legitimate repositories which may help mitigate some of these issues. Not allowing unsigned applications from being run may also mitigate some risk.
• M1028 Operating System Configuration (for T1548) : Applications with known vulnerabilities or known shell escapes should not have the setuid or setgid bits set to reduce potential damage if an application is compromised. Additionally, the number of programs with setuid or setgid bits set should be minimized across a system. Ensuring that the sudo tty_tickets setting is
• M1052 User Account Control (for T1548) : Although UAC bypass techniques exist, it is still prudent to use the highest enforcement level for UAC when possible and mitigate bypass opportunities that exist with techniques such as [DLL](https://attack.mitre.org/techniques/T1574/001).
• M1026 Privileged Account Management (for T1548) : Remove users from the local administrator group on systems. By requiring a password, even if an adversary can get terminal access, they must know the password to run anything in the sudoers file. Setting the timestamp_timeout to 0 will require the user to input their password every time sudo is executed.
• M1018 User Account Management (for T1548) : Limit the privileges of cloud accounts to assume, create, or impersonate additional roles, policies, and permissions to only those required. Where just-in-time access is enabled, consider requiring manual approval for temporary elevation of privileges.
• M1047 Audit (for T1548) : Check for common UAC bypass weaknesses on Windows systems to be aware of the risk posture and address issues where appropriate.
• M1022 Restrict File and Directory Permissions (for T1548) : The sudoers file should be strictly edited such that passwords are always required and that users can't spawn risky processes as users with higher privilege.

Detection Generic guidance

• Execution: Watch for the service process spawning shells or script interpreters (cmd.exe, powershell, sh, bash, python) via EDR process-tree rules.
• Privilege Escalation: Alert on processes gaining SYSTEM/root unexpectedly, and on exploitation crashes of privileged services.
• Discovery: Look for directory listing, file enumeration and reconnaissance commands from service accounts.

Response checklist Generic guidance

1. Inventory: find every instance of the affected product and version (include internet-facing and forgotten ones).
2. Patch or mitigate per the vendor advisory; if you cannot patch, remove internet exposure or apply the vendor workaround.
3. Assume compromise if the system was exposed before patching: hunt for the indicators in the advisory and review logs back to the disclosure date.
4. Rotate credentials and secrets stored on or used by the affected system if compromise cannot be ruled out.