Every CVE Search/ Get API key

CVE-2025-2783

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior...

8.3 HighIn KEVPublic exploitFix available

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

9.24%Up 7.6 points since Mar 27, 2025
90%50%10%1%

What each source reports

CVE List Score used 8.3

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Record
CVE-2025-2783
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
EUVDEUVD-2025-8225 8.3

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Record
EUVD-2025-8225
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-hfqm-jfc6-rh2f 8.3

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior...

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Record
GHSA-hfqm-jfc6-rh2f
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
CISA KEV No score

Google Chromium Mojo Sandbox Escape Vulnerability

Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.

Record
CVE-2025-2783
Updated
2026-11-02
NVD 8.3

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Record
CVE-2025-2783
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-02
OSVALPINE-CVE-2025-2783 8.3

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Record
ALPINE-CVE-2025-2783
CVSS 3.1
8.3 HighCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H
Updated
2026-11-03
OSVopenSUSE-SU-2025:0111-1 No score

Security update for opera

This update for opera fixes the following issues:

  • Update to 117.0.5408.163

    • DNA-120683 [Issue back] Sometimes onboarding is blank and useless
    • DNA-121682 Backport fix for CVE-2025-2783 to O132, O133, GX132 and Air132

  • Changes in 117.0.5408.154

    • DNA-121210 After enabling tab scrolling, the tab bar narrows on both the left and right sides
    • DNA-121560 Extension updates which requires manual confirmation do not work

  • Changes in 117.0.5408.142

    • DNA-121314 Use the extra palette color to paint the frame
    • DNA-121321 Refactor ColorSet struct
    • DNA-121444 Crash at opera::VibesServiceImpl::VibesServiceImpl
    • DNA-121477 Add unit tests for ColorSet
    • DNA-121488 [ASAN] ColorSetTest.DefaultConstructor fails

  • Changes in 117.0.5408.93

    • DNA-118548 After pressing Ctrl+F / Cmd+F on the Start Page (SP), the focus should be on the search bar
    • DNA-121183 Add 'transparent UI' parameter to Vibe logic
    • DNA-121184 Allow to specify extra palette for window background in Vibe logic
    • DNA-121232 Enable Slack, Discord and Bluesky flag on all streams
    • DNA-121237 Crash at opera::SidebarExpandViewEmbedder::Position
    • DNA-121322 [Opera Translate] [Redesign] Expired #translator flag
    • DNA-121385 Remove 'passkey' string

  • Update to 117.0.5408.53

    • DNA-120848 Add 'x' button to close/dismiss translate popup
    • DNA-120849 Dismissing popup adds language to never translate from list
    • DNA-120951 Optimize MFSVE output handling
    • DNA-120972 Crash at TabDesktopMediaList::Refresh
    • CHR-9964 Update Chromium on desktop-stable-132-5408 to 132.0.6834.210 Changes in 117.0.5408.47
    • CHR-9961 Update Chromium on desktop-stable-132-5408 to 132.0.6834.209
Record
openSUSE-SU-2025:0111-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:14961-1 No score

firefox-esr-128.9.0-1.1 on GA media

These are all security issues fixed in the firefox-esr-128.9.0-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:14961-1
Updated
2026-11-02
OSVopenSUSE-SU-2025:15531-1 No score

libQt5Pdf5-5.15.19-1.1 on GA media

These are all security issues fixed in the libQt5Pdf5-5.15.19-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15531-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
qt5-qtwebengine
Alpine:v3.21
 before 5.15.17-r7
5.15.17-r7
qt5-qtwebengine
Alpine:v3.22
 before 5.15.17-r10
5.15.17-r10
qt5-qtwebengine
Alpine:v3.23
 before 5.15.17-r10
5.15.17-r10
qt6-qtwebengine
Alpine:v3.22
 before 6.8.2-r3
6.8.2-r3
qt6-qtwebengine
Alpine:v3.23
 before 6.8.2-r3
6.8.2-r3
qt6-qtwebengine
Alpine:v3.24
 before 6.8.2-r3
6.8.2-r3
opera
openSUSE:Leap 15.6 NonFree
 before 117.0.5408.163-lp156.2.32.1
117.0.5408.163-lp156.2.32.1
firefox-esr
openSUSE:Tumbleweed
From an advisory covering 5 CVEs
 before 128.9.0-1.1
128.9.0-1.1
libqt5-qtwebengine
openSUSE:Tumbleweed
From an advisory covering 16 CVEs
 before 5.15.19-1.1
5.15.19-1.1

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubAlchemist3dot14/CVE-2025-27832025-04-06
PoC in GitHubbyteReaper77/CVE-2025-27832025-06-15
Exploit-DBMicrosoft Edge Renderer Process (Mojo IPC) 134.0.6998.177 - Sandbox Escape2025-08-11
PoC in GitHubbjrjk/CVE-2025-27832026-05-08
PoC in GitHubElianGonzi00/CVE-2025-27832026-06-15
PoC in GitHubrazureink/cve-2025-2783-chrome_sandbox_escape_reproduction2026-07-23

History

History
RecordedChangedSources
affected
exploitation
affected, aliases, exploits, referencesOSV
first indexedCVE List, EUVD, Exploit-DB, GitHub Advisories, CISA KEV, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-2783 is a high vulnerability (CVSS 8.3) in Google Chrome, published March 26, 2025. CISA lists it as known to be exploited, since March 27, 2025. EUVD reports exploitation since March 27, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 9.24%, the 95th percentile. Fixed in qt5-qtwebengine 5.15.17-r7.

References

Show 22 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open