Google Patches High-Severity Chrome Vulnerability: CVE-2025-2783

Google has released an urgent security update to fix a high-severity zero-day vulnerability in its Chrome browser. The flaw, tracked as CVE-2025-2783, was actively exploited to bypass Chrome’s security protections and deploy malware in cyber-espionage attacks targeting Russian organizations.

Critical Chrome Security Flaw Patched

Google acknowledged the issue in a security advisory, stating: “Google is aware of reports that an exploit for CVE-2025-2783 exists in the wild.” The vulnerability was discovered by Kaspersky researchers Boris Larin and Igor Kuznetsov, who described it as an “incorrect handle provided in unspecified circumstances in Mojo on Windows.” Mojo is a set of runtime libraries facilitating inter-process communication (IPC) within Chrome.

The company has rolled out patches to fix the flaw in the Stable Desktop channel for Windows users, updating Chrome to version 134.0.6998.178. While updates are being rolled out gradually, users can manually check for updates to ensure their browser is secure.

Chrome’s Sandbox

Google Chrome’s sandboxing technology is a critical security feature designed to isolate processes and prevent malicious code from affecting the operating system. When users visit a website, Chrome runs each tab as a separate process within a restricted environment. If a website is compromised, the malware is confined to the sandbox, reducing the risk of system-wide infection.

However, CVE-2025-2783 allowed attackers to bypass Chrome’s sandbox, making it a serious security concern. Such vulnerabilities are often used in advanced persistent threat (APT) campaigns, where attackers seek long-term access to compromised networks.

How Attackers Exploited the Chrome Flaw

Although Google has not disclosed full details about the attacks, Kaspersky researchers have provided insights into how the vulnerability was exploited. Attackers leveraged CVE-2025-2783 to evade Chrome’s sandbox security measures, allowing malware to be executed on the target system.

The cyber-espionage campaign, named Operation ForumTroll, used phishing emails to lure victims into clicking malicious links. These emails impersonated the organizers of the Primakov Readings forum, a well-known Russian scientific and expert event. The targets included media outlets, government agencies, and educational institutions in Russia.

Once victims clicked the malicious link, they were redirected to a compromised domain (primakovreadings[.]info) where the exploit was deployed. The malware required no further user interaction, making it a highly effective attack vector.

Additional Exploit Used in Attacks

Kaspersky researchers noted that attackers combined CVE-2025-2783 with a second exploit that enabled remote code execution (RCE). While details of this secondary exploit remain unknown, the patch issued by Google effectively neutralizes the entire attack chain.

The research is ongoing, but based on the sophisticated nature of the malware, Kaspersky suspects that a nation-state-backed APT group is behind the operation.