Chrome Mojo handle vulnerability exploited in phishing attacks
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
CVE-2025-2783 in Chrome's Mojo allows arbitrary code execution via drive-by compromise; actively exploited in the wild.
A vulnerability in Google Chrome's Mojo component (CVE-2025-2783) allows an attacker to achieve arbitrary code execution in the context of the logged-on user. The flaw involves an incorrect handle provided in unspecified circumstances on Windows. Kaspersky researchers confirmed active exploitation: attackers sent phishing emails with links that, when clicked and opened in Chrome, delivered malicious code. Successful exploitation allows the attacker to install programs, view or modify data, delete data, or create new privileged accounts—with impact scaling to administrative privileges if the user holds them.
Chrome versions prior to 134.0.6998.177/.178 on Windows are vulnerable. Google is aware of in-the-wild exploitation. The attack vector is phishing-driven social engineering, making this a critical patch priority. Organizations should prioritize immediate patching, enforce least-privilege account policies to limit impact, and reinforce user training on phishing and untrusted links.
Mentioned in this report
Detection guidance
Chrome Spawning Script Interpreter or LOLBin Child Process
Detects chrome.exe launching a shell, script host or common LOLBin, which can follow browser exploitation or sandbox escape (e.g. CVE-2025-2783) after a phishing link is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Spawning Script Interpreter or LOLBin Child Process
id: 387f4f81-950a-552f-9b04-b08ec7508ecd
status: experimental
description: Detects chrome.exe directly spawning command shells, script hosts or
common living-off-the-land binaries. After a browser exploit such as the Mojo handle
flaw CVE-2025-2783, attacker code running as the user may launch such children.
Generalises on the parent/child relationship, not on any payload name.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \rundll32.exe
- \regsvr32.exe
- \certutil.exe
- \bitsadmin.exe
- \msiexec.exe
condition: selection
falsepositives:
- Browser extensions or native-messaging hosts that launch cmd.exe or PowerShell
- Developers or admins launching scripts through custom Chrome external protocol handlers
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-031
Chrome Sandboxed Child Process Spawning Non-Chrome Process
Detects Chrome renderer, GPU or utility processes (--type=) spawning a non-Chrome child process, which indicates a possible sandbox escape or browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Chrome Sandboxed Child Process Spawning Non-Chrome Process
id: f17a6991-2fa6-52d5-8f45-0714de0c6925
status: experimental
description: Detects a Chrome child process started with a --type= argument (renderer,
gpu-process, utility) that itself spawns a process other than chrome.exe. Sandboxed
Chrome processes should not create arbitrary children, so this is a strong indicator
of a sandbox escape such as CVE-2025-2783 exploitation.
tags:
- attack.initial-access
- attack.t1189
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \chrome.exe
ParentCommandLine|contains: --type=
filter_chrome:
Image|endswith:
- \chrome.exe
- \crashpad_handler.exe
condition: selection and not filter_chrome
falsepositives:
- Chrome utility processes launching legitimate helpers such as print or GPU driver
components
- Security or DLP products that inject helper processes into Chrome
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-031
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-031
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs