CVE-2025-4609
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior...
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
CVE-2025-4609- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2025-25768
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
EUVD-2025-25768- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-c8mh-mfhv-j36q
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior...
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
GHSA-c8mh-mfhv-j36q- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
NVD
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
CVE-2025-4609- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVALPINE-CVE-2025-4609
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
ALPINE-CVE-2025-4609- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
OSV
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
CVE-2025-4609- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
Show 4 moreShow less
OSVDEBIAN-CVE-2025-4609
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
- Record
DEBIAN-CVE-2025-4609- CVSS 3.1
- 9.6 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVMGASA-2025-0159No score
Updated chromium-browser-stable packages fix security vulnerabilities
Heap buffer overflow in HTML. (CVE-2025-4096) Out of bounds memory access in DevTools. (CVE-2025-4050) Insufficient data validation in DevTools. (CVE-2025-4051) Inappropriate implementation in DevTools. (CVE-2025-4052) Use after free in WebAudio. (CVE-2025-4372) Insufficient policy enforcement in Loader. (CVE-2025-4664) Incorrect handle provided in unspecified circumstances in Mojo. (CVE-2025-4609)
- Record
MGASA-2025-0159- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15143-1No score
chromedriver-136.0.7103.113-1.1 on GA media
These are all security issues fixed in the chromedriver-136.0.7103.113-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15143-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15182-1No score
nodejs-electron-35.5.0-1.1 on GA media
These are all security issues fixed in the nodejs-electron-35.5.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15182-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
qt6-qtwebengineAlpine:v3.22 | before 6.8.2-r4 | 6.8.2-r4 |
qt6-qtwebengineAlpine:v3.23 | before 6.8.2-r4 | 6.8.2-r4 |
qt6-qtwebengineAlpine:v3.24 | before 6.8.2-r4 | 6.8.2-r4 |
chromiumDebian:12 | before 136.0.7103.113-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1 | 136.0.7103.113-1~deb12u1 |
chromiumDebian:13 | before 136.0.7103.113-1 | 136.0.7103.113-1 |
chromiumDebian:14 | before 136.0.7103.113-1 | 136.0.7103.113-1 |
chromiumDebian:12 From an advisory covering 2 CVEs | before 136.0.7103.113-1~deb12u1, plus listed versions 113.0.5672.126-1114.0.5735.106-1114.0.5735.106-1~deb11u1114.0.5735.106-1~deb12u1114.0.5735.133-1 Show 45 moreShow less114.0.5735.133-1~deb11u1114.0.5735.133-1~deb12u1114.0.5735.198-1114.0.5735.198-1~deb11u1114.0.5735.198-1~deb12u1114.0.5735.90-1114.0.5735.90-2114.0.5735.90-2~deb11u1114.0.5735.90-2~deb12u1115.0.5790.102-1115.0.5790.102-2115.0.5790.170-1115.0.5790.170-1~deb11u1115.0.5790.170-1~deb12u1115.0.5790.98-1115.0.5790.98-1~deb11u1115.0.5790.98-1~deb12u1115.0.5790.98-2116.0.5845.110-1116.0.5845.110-1~deb11u1116.0.5845.110-1~deb12u1116.0.5845.110-2116.0.5845.140-1116.0.5845.140-1~deb11u1116.0.5845.140-1~deb12u1116.0.5845.180-1116.0.5845.180-1~deb11u1116.0.5845.180-1~deb12u1116.0.5845.96-1116.0.5845.96-1~deb11u1116.0.5845.96-1~deb12u1116.0.5845.96-2117.0.5938.132-1117.0.5938.132-1~deb11u1117.0.5938.132-1~deb12u1117.0.5938.132-2117.0.5938.149-1117.0.5938.149-1~deb11u1117.0.5938.149-1~deb12u1117.0.5938.62-1117.0.5938.62-1~deb11u1117.0.5938.62-1~deb12u1117.0.5938.92-1118.0.5993.117-1118.0.5993.117-1~deb11u1 | 136.0.7103.113-1~deb12u1 |
chromium-browser-stableMageia:9 From an advisory covering 7 CVEs | before 136.0.7103.113-1.mga9.tainted | 136.0.7103.113-1.mga9.tainted |
chromiumopenSUSE:Tumbleweed From an advisory covering 2 CVEs | before 136.0.7103.113-1.1 | 136.0.7103.113-1.1 |
nodejs-electronopenSUSE:Tumbleweed | before 35.5.0-1.1 | 35.5.0-1.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| PoC in GitHub | nek-3231/cve-2025-4609-mojo-poc | 2026-11-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | PoC in GitHub | |
| affected, facts | ||
| affected, aliases, references | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-4609 is a critical vulnerability (CVSS 9.6) in Google Chrome, published May 15, 2025. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.40%, the 34th percentile. Fixed in qt6-qtwebengine 6.8.2-r4.
References
chromereleases.googleblog.com/2025/05/stable-channel-update-for-desktop_14.html
issues.chromium.org/issues/412578726
nvd.nist.gov/vuln/detail/CVE-2025-4609
github.com/advisories/GHSA-c8mh-mfhv-j36q
security.alpinelinux.org/vuln/CVE-2025-4609
security-tracker.debian.org/tracker/CVE-2025-4609
Show 8 moreShow less
advisories.mageia.org/MGASA-2025-0159.html
bugs.mageia.org/show_bug.cgi?id=34235
lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/DAX7YL7E5JSBCWIZ4WMT2VAQNC5BSEBY
suse.com/security/cve/CVE-2025-4609
Left out here: 328 versions. The JSON record has them.