CVE-2025-2783: Google Chrome Mojo sandbox escape via incorrect handle on Windows

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: medium.

critical priorityIt is a Chrome sandbox escape listed in CISA KEV as exploited in the wild, with High CVSS impact and a near-term remediation deadline.

What it is

Google Chrome on Windows before 134.0.6998.177 mishandles a handle in Mojo under unspecified circumstances, allowing a remote attacker to escape the browser sandbox using a malicious file. A sandbox escape is serious because it turns a browser compromise into code execution at the OS level, outside Chrome's containment.

Impact

An attacker who escapes the sandbox gains the ability to run code with the privileges of the Chrome process on the host, breaking the primary containment boundary that limits browser exploits. The CVSS vector rates confidentiality, integrity and availability impact as High.

Attack surface

Reached over the network (AV:N) with no privileges required (PR:N), but user interaction is required (UI:R), consistent with the description's malicious file. The scope is changed (S:C), reflecting the escape from the browser sandbox to the underlying OS.

Exploitation

CVE-2025-2783 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2025-03-27), indicating exploitation in the wild; EPSS gives a 30-day probability of about 9.2% (95th percentile). No ransomware campaign use is documented.

What to do

• Update Google Chrome on Windows to 134.0.6998.177 or later, or to the current stable release, and restart the browser to apply it.
• Follow CISA KEV required action: apply vendor mitigations per instructions, apply BOD 22-01 guidance for cloud services, or discontinue use if mitigations are unavailable.
• Enforce automatic updates and verify version compliance across managed Windows endpoints.
• Restrict or block untrusted file downloads and opening of untrusted files in Chrome where operationally feasible.
• Track the KEV remediation due date of 2025-04-17 and confirm closure.

Detection

• Monitor Chrome version reporting to find Windows endpoints still below 134.0.6998.177.
• Hunt for Chrome renderer or child processes spawning unexpected executables or making anomalous outbound connections, which can indicate a sandbox escape.
• Review endpoint telemetry for suspicious file-open activity originating from Chrome followed by process creation outside the browser's normal child process set.
• Correlate proxy and DNS logs for Chrome-initiated traffic to untrusted destinations around the time of suspicious file opens.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.