Google has fixed a high-severity Chrome zero-day vulnerability exploited to escape the browser's sandbox and deploy malware in espionage attacks targeting Russian organizations. However, Kaspersky researchers who discovered the actively exploited zero-day also published a report with additional details, saying that attackers use CVE-2025-2783 exploits to bypass Chrome sandbox protections and infect targets with sophisticated malware. The vulnerability is now being exploited in phishing attacks, redirecting victims to the primakovreadings[.]info domain as part of a cyber-espionage campaign targeting Russian organizations, dubbed Operation ForumTroll. While analyzing these attacks, Kaspersky researchers found that the attackers also used a second exploit that enabled remote code execution on compromised systems. Although no information on this additional exploit is available, patching Chrome will disable the entire exploit chain and block potential attacks. Google fixed the zero-day for users in the Stable Desktop channel, with patched versions rolling out worldwide to Windows (134.0.6998.178) users. "While research is still ongoing, but judging by the functionality of the sophisticated malware used in the attack, Kaspersky says the attackers' goal was likely espionage," Kaspersky said.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Wed, 26 Mar 2025 06:45:09 +0000