Cybercriminals exploit sophisticated zero-day vulnerability in Chrome

Kaspersky has just discovered and helped patch a serious zero-day vulnerability in Google Chrome browser (CVE-2025-2783). Through this vulnerability, attackers can bypass the browser's sandbox protection mechanism.

Cybercriminals are exploiting zero-day vulnerabilities.

Discovered by Kaspersky's Global Research and Analysis Team (GReAT), the vulnerability doesn't require users to take any action other than clicking on a malicious link and is incredibly complex and sophisticated.

In mid-March 2025, Kaspersky detected a wave of infections that occurred when users clicked on personalized phishing links sent via email. After clicking the link, the user's system was immediately compromised, even if the person did not perform any further actions.

After analyzing and confirming that the attack was exploiting a previously undiscovered vulnerability in the latest version of Chrome, the Kaspersky team immediately alerted the Google security team. A security patch for this vulnerability was later released on March 25, 2025.

“This vulnerability is significantly more dangerous than the dozens of zero-day vulnerabilities we have discovered over the years. Attackers exploiting this vulnerability can bypass Chrome’s sandbox protection mechanism without any explicit actions, as if the browser’s security system is almost non-existent. We recommend that all users update Google Chrome and other Chromium-based browsers to the latest versions to avoid the risk of attacks,” said Boris Larin, Head of Security Research at Kaspersky’s GReAT.

BINH LAM

Source: https://www.sggp.org.vn/toi-pham-mang-khai-thac-lo-hong-zero-day-tinh-vi-tren-chrome-post788885.html