razureink/cve-2025-2783-chrome_sandbox_escape_reproductionCVE Reproduction: cve-2025-2783-chrome_sandbox_escape_reproduction
CVSS Score: 8.3 (High) Discovered by: Kaspersky Status: Actively exploited in the wild (espionage campaigns)
CVE-2025-2783 is a Windows-specific privilege escalation vulnerability in Google Chrome's Mojo Interprocess Communication (IPC) framework. It allows a compromised renderer process to escape the Chrome sandbox by exploiting incorrect handle handling in the Mojo message-passing layer.
This CVE was identified as part of an active exploitation chain targeting journalists and opposition figures. The sandbox escape was paired with a separate renderer remote code execution (RCE) vulnerability to achieve full system compromise.
The vulnerability lies in the Mojo IPC channel's handling of Windows HANDLE objects during message serialization and deserialization. Specifically:
Handle Confusion: The Mojo broker on Windows incorrectly validates and transfers handles between the privileged browser process and sandboxed renderer processes. A crafted IPC message can cause the broker to duplicate a handle into the renderer process with unintended access rights.
Missing Access Check: The broker fails to verify that the renderer is permitted to receive the duplicated handle, effectively allowing any compromised renderer process to request and obtain a handle to sensitive kernel objects.
Elevation of Privilege: Once a malicious renderer obtains the improperly duplicated handle, it can leverage it to perform privileged operations (e.g., process creation, file system access) outside the sandbox boundary.
The exploit flow:
Microsoft's Edge (Chromium-based) and other Chromium-based browsers may also be affected if they had not yet pulled the upstream fix.
WARNING: This is for authorized security research and educational purposes only. Unauthorized testing against live systems is illegal.
--enable-logging --v=1)exploit.pyThe accompanying exploit.py demonstrates the concept of crafting a malicious Mojo IPC message that triggers the handle confusion. It does not contain a working exploit against patched browsers and is intended solely for educational understanding of the vulnerability class.
# See exploit.py for the full demonstration
The official fix addresses the missing access check in the Mojo broker's handle transfer logic. Specifically, the broker now validates that the requesting process has the necessary privileges before duplicating a handle.