CVE-2025-2783

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2025-2783 is an incorrect handle issue in the Mojo component of Google Chrome on Windows in versions prior to 134.0.6998.177. The flaw permits a sandbox escape when a malicious file is processed under unspecified circumstances, carrying a CVSS 3.1 score of 8.3 reflecting network attack vector, high complexity, required user interaction, and full impact across confidentiality, integrity, and availability once the sandbox boundary is crossed.

A remote attacker can exploit the vulnerability by supplying a crafted file that the victim must open in an affected Chrome instance. Successful exploitation yields a sandbox escape, allowing code execution outside Chrome's security sandbox with the potential to affect the underlying Windows system at a high impact level.

The referenced Google Chrome stable channel update for desktop dated 25 March 2025 upgrades the browser to version 134.0.6998.177 to address the issue. The vulnerability is also catalogued in CISA's Known Exploited Vulnerabilities list, confirming that mitigation through patching is required for affected Windows deployments.

The EPSS score rose from lower values to a peak of 0.5010 on 18 February 2026 before receding to the current 0.4686, indicating that exploitation interest increased after public disclosure.