# Chrome Mojo handle vulnerability exploited in phishing attacks

Published: 2026-06-09 · Severity: high · Sectors: government-national, financial-services, technology
Canonical: https://vorant.io/reports/4b657ba2-b4fb-539d-8830-c497fe86890e/chrome-mojo-handle-vulnerability-exploited-in-phishing-attacks

> CVE-2025-2783 in Chrome's Mojo allows arbitrary code execution via drive-by compromise; actively exploited in the wild.

A vulnerability in Google Chrome's Mojo component (CVE-2025-2783) allows an attacker to achieve arbitrary code execution in the context of the logged-on user. The flaw involves an incorrect handle provided in unspecified circumstances on Windows. Kaspersky researchers confirmed active exploitation: attackers sent phishing emails with links that, when clicked and opened in Chrome, delivered malicious code. Successful exploitation allows the attacker to install programs, view or modify data, delete data, or create new privileged accounts—with impact scaling to administrative privileges if the user holds them.

Chrome versions prior to 134.0.6998.177/.178 on Windows are vulnerable. Google is aware of in-the-wild exploitation. The attack vector is phishing-driven social engineering, making this a critical patch priority. Organizations should prioritize immediate patching, enforce least-privilege account policies to limit impact, and reinforce user training on phishing and untrusted links.

## Mentioned in this report

- Vulnerabilities: CVE-2025-2783 (KEV)

## Detection guidance (public sample)

### Chrome Spawning Script Interpreter or LOLBin Child Process

ATT&CK: T1189

Detects chrome.exe launching a shell, script host or common LOLBin, which can follow browser exploitation or sandbox escape (e.g. CVE-2025-2783) after a phishing link is opened. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Spawning Script Interpreter or LOLBin Child Process
id: 387f4f81-950a-552f-9b04-b08ec7508ecd
status: experimental
description: Detects chrome.exe directly spawning command shells, script hosts or
  common living-off-the-land binaries. After a browser exploit such as the Mojo handle
  flaw CVE-2025-2783, attacker code running as the user may launch such children.
  Generalises on the parent/child relationship, not on any payload name.
tags:
- attack.initial-access
- attack.t1189
- attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \msiexec.exe
  condition: selection
falsepositives:
- Browser extensions or native-messaging hosts that launch cmd.exe or PowerShell
- Developers or admins launching scripts through custom Chrome external protocol handlers
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-031
```

### Chrome Sandboxed Child Process Spawning Non-Chrome Process

ATT&CK: T1189

Detects Chrome renderer, GPU or utility processes (--type=) spawning a non-Chrome child process, which indicates a possible sandbox escape or browser exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Chrome Sandboxed Child Process Spawning Non-Chrome Process
id: f17a6991-2fa6-52d5-8f45-0714de0c6925
status: experimental
description: Detects a Chrome child process started with a --type= argument (renderer,
  gpu-process, utility) that itself spawns a process other than chrome.exe. Sandboxed
  Chrome processes should not create arbitrary children, so this is a strong indicator
  of a sandbox escape such as CVE-2025-2783 exploitation.
tags:
- attack.initial-access
- attack.t1189
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \chrome.exe
    ParentCommandLine|contains: --type=
  filter_chrome:
    Image|endswith:
    - \chrome.exe
    - \crashpad_handler.exe
  condition: selection and not filter_chrome
falsepositives:
- Chrome utility processes launching legitimate helpers such as print or GPU driver
  components
- Security or DLP products that inject helper processes into Chrome
level: high
author: Vorant
references:
- https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-031
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.cisecurity.org/advisory/a-vulnerability-in-google-chrome-could-allow-for-arbitrary-code-execution_2025-031

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/4b657ba2-b4fb-539d-8830-c497fe86890e/chrome-mojo-handle-vulnerability-exploited-in-phishing-attacks.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup