Loading story…
Attackers exploited CVE-2025-2783, a Windows-specific Google Chrome sandbox-escape vulnerability, in Operation ForumTroll phishing campaigns targeting Russian media, education, and government organizations. Specially crafted links triggered exploitation when opened in Chrome. The flaw involves improper handle management in Chrome’s Mojo inter-process communication framework, enabling attackers to bypass the browser sandbox as part of an attack chain. Kaspersky researchers Boris Larin and Igor Kuznetsov reported the vulnerability to Google, which released a patch on March 25, 2025; Italy’s CSIRT subsequently warned of active exploitation.
Organizations should update Windows installations of Chrome to version 134.0.6998.177/.178 or newer, following Google’s security bulletin, and verify deployment across managed endpoints. Additional defenses include reducing phishing exposure and monitoring suspicious renderer-process behavior. Although the Italian advisory reported an online proof of concept, the Python example linked by SecureLayer7 is explicitly a simulation, not a demonstrated exploit; its detailed patch-diff claims are also unsupported by identifiable commits or actual diffs in the supplied material.
See which actors are running it and whether you're in range.
5 events from the most recent confirmed update back to the earliest known activity.
Google released Chrome 134.0.6998.177 with a fix for CVE-2025-2783. The Italian CSIRT advisory identifies Windows versions preceding 134.0.6998.177/.178 as affected and recommends updating.
The SecureLayer7 reference identifies March 25, 2025, as the disclosure date for CVE-2025-2783, a Chrome sandbox-escape vulnerability affecting Windows.
Italian CSIRT issued an advisory reporting active exploitation through phishing links and stating that a proof of concept was available online. The supplied advisory does not establish that the reported proof of concept successfully exploits the vulnerability.
Kaspersky researchers Boris Larin and Igor Kuznetsov discovered the Chrome Mojo vulnerability and reported it to Google. The flaw involved improper handle validation and management, allowing execution outside the browser sandbox.
Attackers exploited CVE-2025-2783 as a zero-day during Operation ForumTroll, targeting organizations in Russia’s media, education, and government sectors. Specially crafted phishing links enabled Chrome sandbox escape and arbitrary code execution on Windows.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Correlate live exploitation activity against the software you actually run, and see where you're exposed.
3 references tracked. Mallory keeps watching after this page renders.
blog.securelayer7.net
Open sourceacn.gov.it
Open sourcecve.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Google released a **Stable Channel Update for Desktop** to fix `CVE-2025-2783`, a critical Chrome zero-day affecting Windows that allows a **sandbox escape** through a logical error at the browser and operating system interface. The flaw is in Chrome's **Mojo** component, carries a `CVSS 9.8` rating, and affects versions earlier than `134.0.6998.177`. Security researchers at Kaspersky, **Boris Larin** and **Igor Kuznetsov**, discovered the vulnerability, and CSIRT.SK reported that it was being **actively exploited** in attacks targeting Russian companies. Users were urged to update Chrome immediately to versions `134.0.6998.177` or `134.0.6998.178`, and organizations using other **Chromium-based browsers** were advised to apply corresponding vendor patches as they become available.
Jul 24, 2026
Google has released an emergency security update to address CVE-2025-13223, a critical zero-day vulnerability in the V8 JavaScript engine used by Chrome and Chromium-based browsers. This type confusion flaw, discovered by Clément Lecigne of Google’s Threat Analysis Group (TAG), allows attackers to achieve heap corruption and potentially execute arbitrary code simply by luring users to maliciously crafted websites. The vulnerability has been actively exploited in the wild, with Google confirming that threat actors are weaponizing it to bypass browser sandbox protections, steal credentials, escalate privileges, and deploy malware. The fix is included in Chrome version 142.0.7444.175/.176 for Windows, Mac, and Linux, and users are strongly urged to update and restart their browsers immediately to mitigate risk. Other Chromium-based browsers, including Microsoft Edge, Brave, Opera, and Vivaldi, are also rolling out patches. The involvement of Google TAG suggests possible links to advanced persistent threats, highlighting the urgency for both individuals and enterprises to apply updates and monitor for suspicious activity.
Jun 29, 2026
Google released an urgent *Chrome for Desktop* Stable Channel update to address **CVE-2026-2441**, a high-severity zero-day that Google said has an exploit **active in the wild**. The issue is a **use-after-free in Chrome’s CSS component**, a memory-corruption flaw that can enable code execution in the browser context when a user visits a malicious or compromised webpage; the vulnerability was reported to Google by researcher **Shaheen Fazim**. The Canadian Centre for Cyber Security echoed the need to patch Chrome, advising organizations to update beyond affected Stable Channel versions (Windows/Mac prior to `145.0.7632.68` and Linux prior to `144.0.7559.67`), while third-party reporting indicated patched Stable builds rolling out to `145.0.7632.75/.76` (Windows/Mac) and `144.0.7559.75` (Linux). Other Canadian Centre advisories published in the same period covered unrelated vendor patches for **Tenable Nessus Agent** (CVE-2026-2026), **Juniper Secure Analytics (JSA)**, **HPE SimpliVity** (Intel firmware advisories), and **PostgreSQL** point releases; these are separate remediation items and not part of the Chrome zero-day event.
Jun 29, 2026