CVE-2025-2783 — Google Chromium Mojo Sandbox Escape Vulnerability

provenance: imported · CVE: CVE-2025-2783

CVE-2025-2783: Google Chromium Mojo Sandbox Escape Vulnerability

CISA Known Exploited Vulnerability (KEV)


Vendor / project	Google
Product	Chromium Mojo
Date added	2025-03-27
Due date	2025-04-17
Ransomware campaign use	Unknown

Description

Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Required action (CISA)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Notes

https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html ; https://nvd.nist.gov/vuln/detail/CVE-2025-2783

References

NVD: https://nvd.nist.gov/vuln/detail/CVE-2025-2783
KEV catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog

concept/cve-anatomy