GHSA-f87w-3j5w-v58p
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
GHSA-f87w-3j5w-v58p is a high vulnerability (CVSS 8.3) in CefSharp.Wpf, published April 12, 2025. No source lists public exploit code. Fixed in CefSharp.Wpf 134.3.90.
- Severity
- 8.3 HighCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
134.3.90CefSharp.Wpf +13 more
Description
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
CefSharp.WpfNuGet | before 134.3.90 | 134.3.90 |
CefSharp.Wpf.HwndHostNuGet | before 134.3.90 | 134.3.90 |
CefSharp.Wpf.NetCoreNuGet | before 134.3.90 | 134.3.90 |
CefSharp.WinFormsNuGet | before 134.3.90 | 134.3.90 |
CefSharp.WinForms.NetCoreNuGet | before 134.3.90 | 134.3.90 |
CefSharp.OffScreen.NetCoreNuGet | before 134.3.90 | 134.3.90 |
CefSharp.OffScreenNuGet | before 134.3.90 | 134.3.90 |
CefSharp.WpfNuGet | before 134.3.90, plus listed versions 1.25.2-perlun01.25.31.25.41.25.51.25.6 Show 45 moreShow less1.25.71.25.8100.0.120-pre100.0.140100.0.230101.0.150101.0.180102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20 | 134.3.90 |
CefSharp.Wpf.HwndHostNuGet | before 134.3.90, plus listed versions 100.0.140101.0.150101.0.180102.0.90103.0.120 Show 45 moreShow less103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.150116.0.230117.2.20118.6.80119.1.20120.1.110120.1.80120.2.50120.2.70121.3.70123.0.60124.3.20124.3.50124.3.80125.0.210126.2.70127.3.50128.4.90129.0.110130.1.90 | 134.3.90 |
CefSharp.Wpf.NetCoreNuGet | before 134.3.90, plus listed versions 100.0.120-pre100.0.140100.0.230101.0.150101.0.180 Show 45 moreShow less102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20119.4.30120.1.110120.1.80120.2.50120.2.70121.3.130121.3.70 | 134.3.90 |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
CefSharp.WinFormsNuGet | before 134.3.90, plus listed versions 1.25.3100.0.120-pre100.0.140100.0.230101.0.150 Show 45 moreShow less101.0.180102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20119.4.30120.1.110120.1.80120.2.50120.2.70121.3.130 | 134.3.90 |
CefSharp.WinForms.NetCoreNuGet | before 134.3.90, plus listed versions 100.0.120-pre100.0.140100.0.230101.0.150101.0.180 Show 45 moreShow less102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20119.4.30120.1.110120.1.80120.2.50120.2.70121.3.130121.3.70 | 134.3.90 |
CefSharp.OffScreen.NetCoreNuGet | before 134.3.90, plus listed versions 100.0.120-pre100.0.140100.0.230101.0.150101.0.180 Show 45 moreShow less102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20119.4.30120.1.110120.1.80120.2.50120.2.70121.3.130121.3.70 | 134.3.90 |
CefSharp.OffScreenNuGet | before 134.3.90, plus listed versions 100.0.120-pre100.0.140100.0.230101.0.150101.0.180 Show 45 moreShow less102.0.100102.0.90103.0.120103.0.80103.0.90104.4.180104.4.240105.3.330105.3.390106.0.260106.0.290107.1.120107.1.40107.1.50107.1.90108.4.130109.1.110110.0.250110.0.280110.0.300111.2.20111.2.70112.2.70112.3.0113.1.40113.3.50114.2.100114.2.120115.3.110115.3.130116.0.130116.0.150116.0.190116.0.230117.2.20117.2.40118.6.80119.1.20119.4.30120.1.110120.1.80120.2.50120.2.70121.3.130121.3.70 | 134.3.90 |
What each source reports
GitHub Advisories Score used
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032
- Record
GHSA-f87w-3j5w-v58p- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSV
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032
- Record
GHSA-f87w-3j5w-v58p- CVSS 3.1
- 8.3 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
github.com/cefsharp/CefSharp/security/advisories/GHSA-f87w-3j5w-v58p
nvd.nist.gov/vuln/detail/CVE-2025-2783
chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html
issues.chromium.org/issues/405143032
Left out here: 655 versions. The JSON record has them.