8.3

CVE-2025-2783: Google Chromium Mojo Sandbox Escape Vulnerability

CVSS: 8.3v3.1HighKEVAnalyzed
AliasesCGA-ph2x-22j4-29rcCGA-ph92-j6g4-889qopenSUSE-SU-2025:0111-1
Published 26-03-2025Last modified 26-02-2026
Open JSON

Vulnerability summary

CVE-2025-2783 is a high (CVSS 8.3) vulnerability in Google Chromium Mojo. It is known to be exploited: CISA lists it, first on 27-03-2025. EPSS estimates a 9.24% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
85/100
0100
Critical · default modelHow is this calculated?
CVSS score
8.3/10
010
High · v3.1 (CVE.org)
EPSS score
9.24%
0%100%
Low · 0.00 pp in 30 days
KEVListedCISA
RansomwareNone recordedNo known use recorded
Public exploits1exploit-database

Advisory lineage

Upstream 0 · Downstream 2 · Related 3
OPENSUSE-SU-2025:14961-1OPENSUSE-SU-2025:15531-1CGA-95GP-GC8C-CVQQ

Timeline

  1. 26-03-2025
    PublishedVulnerability first disclosed.
  2. 27-03-2025
    Added to CISA KEVGoogle Chromium Mojo Sandbox Escape Vulnerability
  3. 17-04-2025
    CISA remediation dueApply mitigations per vendor instructions.
  4. 26-02-2026
    Last modifiedVulnerability information updated.

Description

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

CVSS metrics

4 scores · 4 sources · 1 version

EPSS trend

Probability

9.24%

Chance of exploitation in the next 30 days

Percentile

95%

Versus all other CVEs

30-day change

0.00 pp

From 9.24% on 21-09-2026

21-09-202621-10-2026
EPSS score
9.24%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
27-03-2025
Federal due date
17-04-2025

CISA required action

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html nvd.nist.gov/vuln/detail/CVE-2025-2783

Public exploits

1 found
  • exploit-databasewindowsUnverified

    Microsoft Edge Renderer Process (Mojo IPC) 134.0.6998.177 - Sandbox Escape

    Maturity: poc

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Chainguard1 product
  • chromiumAll versions (No fix recorded)
Google1 product
  • chrome≥ 134.0.6998.177, < 134.0.6998.177 | < 134.0.6998.177
Opensuse1 product
  • opera&distro=openSUSE Leap 15.6 NonFree< 117.0.5408.163-lp156.2.32.1
Wolfi1 product
  • chromiumAll versions (No fix recorded)

4 vendors · 4 products

References

5 links