---
title: "Chrome CVE-2025-2783: Mojo Sandbox Escape Zero-Day"
url: https://erroneo.us/security/briefs/chrome-cve-2025-2783-mojo-sandbox-escape/
description: "Chrome on Windows before 134.0.6998.177 had a Mojo sandbox escape used in Operation ForumTroll. Fixed March 2025; most auto-updated users can relax."
type: security-brief
section: "Security Digest"
date_published: 2025-03-25
date_modified: 2026-10-21
publisher: erroneo.us
author: erroneo.us Security Desk
verdict: "Most can relax"
cves: ["CVE-2025-2783"]
severity: "high"
exploited: "in-the-wild"
kev: true
license: All rights reserved. Quote with attribution and a link.
---

# Chrome CVE-2025-2783: Mojo Sandbox Escape Zero-Day

**Verdict: Most can relax.** A real zero-day used for espionage in early 2025, long since fixed by Chrome's automatic updates; the lasting lesson is to make sure auto-update actually works on your fleet.

- **Who must act:** Admins of Windows fleets where Chrome updates are pinned, deferred or broken, and anyone still running Chrome 134.0.6998.176 or older on Windows.
- **Who can relax:** Users whose Chrome auto-updates and has been restarted since March 2025, plus all macOS, Linux, Android and iOS users of Chrome for this specific bug.
- **Affected:** Google Chrome for Windows before 134.0.6998.177
- **Fixed:** Google Chrome 134.0.6998.177/.178 for Windows (Stable, March 25, 2025); Extended Stable 134.0.6998.178 for Windows
- **CVEs:** CVE-2025-2783
- **CISA KEV:** yes · **Exploitation:** Exploited in the wild

## What to do

1. Confirm Chrome is current: open chrome://settings/help and relaunch if an update is pending.
2. In managed fleets, report on Chrome versions and flag any endpoint far behind the current Stable release.
3. Remove policies that pin or indefinitely defer Chrome updates, or set a short maximum deferral.
4. Update Firefox on Windows to 136.0.4 / ESR 128.8.1 / ESR 115.21.1 or later, which fixed a similar handle bug (CVE-2025-2857).
5. Treat unexpected event or conference invitations with one-click links as phishing.

### How to check if you are affected

- Search proxy and DNS logs for primakovreadings[.]info, the ForumTroll phishing domain Kaspersky published.
- Review EDR telemetry for Chrome child processes spawning unexpected executables or loading unsigned DLLs, especially from March 2025.
- Check Kaspersky's Securelist reporting for LeetAgent and Dante IOCs if you operate in Russia or Belarus or in sectors ForumTroll targeted.

## What happened

On March 25, 2025, Google shipped [Chrome 134.0.6998.177/.178 for Windows](https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html) to fix one high-severity bug, CVE-2025-2783. Google described it as an "incorrect handle provided in unspecified circumstances in Mojo", Chrome's inter-process communication layer. Google said it was "aware of reports that an exploit for CVE-2025-2783 exists in the wild." Boris Larin and Igor Kuznetsov of Kaspersky reported it on March 20.

The same day, [Kaspersky described Operation ForumTroll](https://securelist.com/operation-forumtroll/115989/). In mid-March 2025, Russian media outlets, educational institutions and government bodies received personalized phishing emails posing as invitations to the "Primakov Readings" forum. Opening the link in Chrome was enough. The exploit escaped Chrome's sandbox through a logic flaw where the sandbox meets Windows. Kaspersky said it was meant to be paired with a separate remote code execution exploit, which Kaspersky did not obtain. Kaspersky assessed the attacker as a state-sponsored APT focused on espionage.

In October 2025, [Kaspersky linked ForumTroll's tooling](https://www.kaspersky.com/about/press-releases/kaspersky-great-spot-new-hackingteam-spyware-in-the-wild-after-years-of-silence), a spyware called LeetAgent, to "Dante", commercial spyware associated with Memento Labs, the successor to HackingTeam. It also reported additional targets in Russia and Belarus.

## Who is affected

Per the [CVE record](https://cveawg.mitre.org/api/cve/CVE-2025-2783), the bug affects Google Chrome on Windows before 134.0.6998.177. CISA's ADP scored it CVSS 3.1 8.3. Other platforms were not affected by this bug. Mozilla found a similar handle pattern in Firefox's IPC code and fixed it as [CVE-2025-2857](https://www.mozilla.org/en-US/security/advisories/mfsa2025-19/) in Firefox 136.0.4, ESR 128.8.1 and ESR 115.21.1 (Windows only). Mozilla did not report that bug as exploited.

## Do you really need to act?

For this bug, almost certainly not anymore. Chrome updates itself, and the fix is 19 months old. CISA added CVE-2025-2783 to the [KEV catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog) on March 27, 2025. The attacks were narrow, targeted espionage, not mass exploitation.

The useful takeaway is a pattern. CVE-2025-2783 was only the first of several Chrome bugs Google flagged as exploited in 2025:

- **CVE-2025-4664** (Loader cross-origin leak): fixed in [136.0.7103.113](https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html) on May 14. Google said "knowledge of" it existed in the wild.
- **CVE-2025-5419** (V8 out-of-bounds read/write): fixed in [137.0.7151.68](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html) on June 2. Added to KEV June 5.
- **CVE-2025-6554** (V8 type confusion): mitigated by a configuration push on June 26, then fixed in [138.0.7204.96 (Windows) / 138.0.7204.92 (Mac, Linux)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html) on June 30. Added to KEV July 2.
- **CVE-2025-6558** (ANGLE/GPU input validation, possible sandbox escape): fixed in [138.0.7204.157](https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html) on July 15. Added to KEV July 22.

Each was fixed within days and delivered automatically. The people who stayed exposed were the ones whose updates were pinned, deferred, or downloaded but waiting on a browser restart.

## What to do now

1. Open `chrome://settings/help` and relaunch if prompted.
2. In managed fleets, report Chrome versions from your MDM or inventory tool and chase anything well behind current Stable.
3. Remove policies that pin Chrome versions or defer updates indefinitely. Enforce a relaunch deadline so downloaded updates actually apply.
4. Confirm Firefox on Windows is past 136.0.4 / ESR 128.8.1 / ESR 115.21.1.
5. Remind staff that targeted invitations with one-click links are a common delivery method.

## How to tell if you were hit

Almost no organizations were targeted. If you operate in Russia or Belarus, or in the sectors Kaspersky named, search DNS and proxy logs for `primakovreadings[.]info` around March 2025. Review EDR data for Chrome child processes launching unexpected binaries. Kaspersky's Securelist reporting carries further LeetAgent and Dante indicators.

## Timeline

- Mar 20, 2025 — Kaspersky reports the bug to Google.
- Mar 25, 2025 — Chrome 134.0.6998.177/.178 is released, and Kaspersky publishes Operation ForumTroll.
- Mar 27, 2025 — CISA adds the CVE to KEV. Mozilla fixes the similar CVE-2025-2857 the same day.
- Oct 27, 2025 — Kaspersky links ForumTroll tooling to Memento Labs' Dante spyware.

## Sources

1. [Google Chrome Releases — Stable Channel Update for Desktop (Mar 25, 2025)](https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html)
2. [Kaspersky Securelist — Operation ForumTroll](https://securelist.com/operation-forumtroll/115989/)
3. [CVE Program — CVE-2025-2783 record (JSON)](https://cveawg.mitre.org/api/cve/CVE-2025-2783)
4. [Kaspersky — HackingTeam successor spyware found in the wild (Oct 27, 2025)](https://www.kaspersky.com/about/press-releases/kaspersky-great-spot-new-hackingteam-spyware-in-the-wild-after-years-of-silence)
5. [Mozilla — Security Advisory 2025-19 (CVE-2025-2857)](https://www.mozilla.org/en-US/security/advisories/mfsa2025-19/)
6. [CISA — Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
7. [Google Chrome Releases — Stable Channel Update for Desktop (May 14, 2025)](https://chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html)
8. [Google Chrome Releases — Stable Channel Update for Desktop (Jun 2, 2025)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop.html)
9. [Google Chrome Releases — Stable Channel Update for Desktop (Jun 30, 2025)](https://chromereleases.googleblog.com/2025/06/stable-channel-update-for-desktop_30.html)
10. [Google Chrome Releases — Stable Channel Update for Desktop (Jul 15, 2025)](https://chromereleases.googleblog.com/2025/07/stable-channel-update-for-desktop_15.html)

---
Source page: https://erroneo.us/security/briefs/chrome-cve-2025-2783-mojo-sandbox-escape/ · Security Digest: https://erroneo.us/security/ · More: https://erroneo.us/llms.txt