CVE-2025-2783
Published: March 27, 2025
Official Description
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
CISA KEV Advisory
Google Chromium Mojo Sandbox Escape Vulnerability
Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
Risk Analysis
A logic error in Google Chromium's Mojo component on Windows can lead to a sandbox escape, allowing an attacker to bypass security restrictions. With an EPSS score of 0.41650 and inclusion in CISA's KEV, this vulnerability is actively exploited and presents a critical risk to systems running affected browsers.
This vulnerability is actively exploited in the wild and is listed in CISA's KEV. While the exact trigger is unspecified, it involves an incorrect handle being provided, likely through user interaction with a malicious web page.
Update all Chromium-based web browsers, such as Google Chrome, Microsoft Edge, and Opera, to the latest secure versions. Ensure operating systems are kept current to benefit from the latest security enhancements and sandbox protections.
Technical Analysis
CVE-2025-2783 requires local access, meaning attackers must already have a foothold on the target system.
Exploitation requires some privileges, which limits the exposure to scenarios where an attacker has already gained initial access.
CISA has added CVE-2025-2783 to the Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild. U.S. federal agencies are required to patch this within the mandated timeframe, and all organizations should treat remediation as urgent.
Affected Vendors & Products
Exploit & PoC Resources
News & Research Mentioning CVE-2025-2783
View CSAF Summary COMOS is affected by multiple vulnerabilities that could allow an attacker to execute arbitrary code or cause denial of service condition, data infiltration or perform access control violations. Siemens has released new versions for several affected products and recommends to update to the latest versions. Siemens is preparing further fix versions and recommends countermeasures for products where fixes are not, or not yet available. The following versions of Siemens COMOS are affected: COMOS V10.4 vers:intdot/<10.4.5, vers:intdot/<10.4.5 (CVE-2024-47875, CVE-2025-2783) COMOS V10.4.5 vers:intdot/<10.4.5.0.2 (CVE-2024-11053, CVE-2025-10148) COMOS V10.5 vers:intdot/<10.5.2, vers:intdot/<10.5.2 (CVE-2025-2783, CVE-2024-47875) COMOS V10. [xlite_meta score:53 src:CISA Alerts xlite_fp:29eb0c7b55e4cae194626fc5a480e23617554ce492db959d2b386d3e2b007910]
All References (2)
Quick Facts
Known Threat Actors
Recommended Actions
- →Apply vendor patches immediately
- →Monitor CVE-2025-2783 in threat intel feeds
- →Review IDS/IPS signatures for exploitation attempts
- !CISA KEV: Federal agencies must patch per BOD 22-01 timeline
- !Active exploitation confirmed — treat as P1