CVE-2025-2783

HighCVSS 8.3/10Known exploited (CISA KEV)Last modified Jun 17, 2026

Description

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)

Metrics

CVSS 3.1 8.3/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

Affected software

No affected versions have been published.

Timeline

Published
Mar 26, 2025
Last modified
Jun 17, 2026
Added to CISA KEV
Mar 27, 2025
NVD status
Analyzed

Related CVEs from 2025

CVE-2025-278307.8An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs during serialization of DollarBlend in a font, for bCVE-2025-278319.8An issue was discovered in Artifex Ghostscript before 10.05.0. The DOCXWRITE TXTWRITE device has a text buffer overflow via long characters CVE-2025-278329.8An issue was discovered in Artifex Ghostscript before 10.05.0. The NPDL device has a Compression buffer overflow for contrib/japanese/gdevnpCVE-2025-278337.8An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs for a long TTF font name to pdf/pdf_fmap.c.CVE-2025-278347.8An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs via an oversized Type 4 function in a PDF document tCVE-2025-278357.8An issue was discovered in Artifex Ghostscript before 10.05.0. A buffer overflow occurs when converting glyphs to Unicode in psi/zbfont.c.CVE-2025-278369.8An issue was discovered in Artifex Ghostscript before 10.05.0. The BJ10V device has a Print buffer overflow in contrib/japanese/gdev10v.c.CVE-2025-278379.8An issue was discovered in Artifex Ghostscript before 10.05.0. Access to arbitrary files can occur through a truncated path with invalid UTFCVE-2025-278393.2operations/attestation/AttestationTask.kt in the Tangem SDK before 5.18.3 for Android has a logic flow in offline wallet attestation (genuinCVE-2025-27846.5A flaw was found in libsoup. The package is vulnerable to a heap buffer over-read when sniffing content via the skip_insight_whitespace() fuCVE-2025-278406.8Espressif ESP32 chips allow 29 hidden HCI commands, such as 0xFC02 (Write memory).CVE-2025-278459.8In ESPEC North America Web Controller 3 before 3.3.4, /api/v4/auth/ with any invalid authentication request results in exposing a JWT secret
CVE-2025-2783: High severity, CVSS 8.3 | Vulnix