Coverage › CVE-2025-2783
CVE-2025-2783 Mapped Partial Sigma
Google Chromium Mojo Sandbox Escape Vulnerability
- Vendor / product
- Google — Chromium Mojo
- Description (CISA)
- Google Chromium Mojo on Windows contains a sandbox escape vulnerability caused by a logic error, which results from an incorrect handle being provided in unspecified circumstances. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
- Added to KEV
- 2025-03-27
- Due date
- 2025-04-17
- Required action
- Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.
- Known ransomware use
- Unknown
- CWE
- none recorded by CISA
- CISA notes
- https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html
https://nvd.nist.gov/vuln/detail/CVE-2025-2783 - Elsewhere
- cve.org · NVD · CISA KEV · JSON
ATT&CK techniques · CTID Mappings Explorer, ATT&CK 16.1, KEV snapshot 2025-07-28
3 mapping objects across 3 techniques. exploitation technique states how the vulnerability is exploited; primary and secondary impact state what exploitation achieves. They are different claims and are labelled as such.
| Technique | Mapping type | CTID comment | Status in v19.2 |
|---|---|---|---|
| T1203 Exploitation for Client Execution | exploitation technique | This vulnerability allows attackers to escape Chrome’s sandbox through a Mojo IPC message crafted to trigger higher privilege. Exploitation has been reported as part of a cyber-espionage campaign. ref 1 |
live |
| T1497 Virtualization/Sandbox Evasion | secondary impact | This vulnerability allows attackers to escape Chrome’s sandbox through a Mojo IPC message crafted to trigger higher privilege. Exploitation has been reported as part of a cyber-espionage campaign. ref 1 |
live |
| T1548 Abuse Elevation Control Mechanism | primary impact | This vulnerability allows attackers to escape Chrome’s sandbox through a Mojo IPC message crafted to trigger higher privilege. Exploitation has been reported as part of a cyber-espionage campaign. ref 1 |
live |
Detection chain · ATT&CK Enterprise v19.2 detection strategies, analytics, log sources
T1203 Exploitation for Client Execution exploitation technique
- DET0287 Exploitation for Client Execution – cross-platform behavior chain (browser/Office/3rd-party apps)
AN0797 WindowsCause→effect chain: (1) A client app (browser, Office, PDF/Flash/reader) experiences a crash/abnormal exit or loads from an unusual location, then (2) drops or modifies a file in user-writable paths, and/or (3) spawns an unexpected child (e.g., powershell/cmd/mshta/rundll32/wscript/installer), and (4) establishes outbound C2-like connections shortly after. Correlate application logs, file writes, process lineage, and network egress within a short window.Tunable:
TimeWindowHighRiskChildrenUserPathsAllowedPluginsEgressAllowlistAN0798 LinuxCause→effect chain: (1) Browser/Office/reader process logs crash/segfault or abnormal sandbox message, (2) new executable/script/write occurs in $HOME (Downloads, ~/.cache, /tmp), (3) unexpected child like curl/wget/bash/python opens network connections soon after.Tunable:TimeWindowUserPathsHighRiskChildrenPackageUpdatersAN0799 macOSCause→effect chain: (1) App crash/abnormal termination in unified logs for Safari/Chrome/Office/Preview, (2) new files/scripts in ~/Library, ~/Downloads, /private/var/folders/*, (3) unexpected child (osascript, zsh, bash, curl) spawned by those apps, (4) new outbound connections.Tunable:TimeWindowHighRiskChildrenUserPathsQuarantineBypass
Sigma rules tagged attack.t1203 (35)
Author: Florian Roth (Nextron Systems)
· 2017-11-07 (modified 2023-05-18) · logsource: category=proxy · 00d0b5ab-1f55-4120-8e83-487c0a7baf19
Detects download of certain file types from hosts in suspicious TLDs
Author: Florian Roth (Nextron Systems)
· 2019-10-24 (modified 2021-11-27) · logsource: product=windows category=process_creation · 023394c4-29d5-46ab-92b8-6a534c6f447b
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Author: Sohan G (D4rkCiph3r)
· 2023-04-05 · logsource: product=macos category=process_creation · 0250638a-2b28-4541-86fc-ea4c558fa0c6
Detects suspicious child processes spawned from browsers. This could be a result of a potential web browser exploitation.
Author: Arnim Rupp (Nextron Systems)
· 2026-06-15 · logsource: category=antivirus · 101a1877-2cf4-474d-abfd-7f6ac4788d1a
Detects a highly relevant Antivirus alert that reports APT malware.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-08-31 · logsource: product=windows category=process_creation · 146aace8-9bd6-42ba-be7a-0070d8027b76
Detects potentially suspicious child processes of WinRAR.exe.
Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research), MSTIC
· 2021-10-15 (modified 2022-10-05) · logsource: product=linux category=process_creation · 21541900-27a9-4454-9c4c-3f0a4240344a
Rule to detect the use of the SCX RunAsProvider Invoke_ExecuteShellCommand to execute any UNIX/Linux command using the /bin/sh shell.
SCXcore, started as the Microsoft Operations Manager UNIX/Linux Agent, is now used in a host of products including
Microsoft Operations Manager, Microsoft Azure, and Microsoft Operations Management Suite.
Author: Florian Roth (Nextron Systems), Arnim Rupp
· 2018-09-09 (modified 2026-06-15) · logsource: category=antivirus · 238527ad-3c2c-4e4f-a1f6-92fd63adb864
Detects a highly relevant Antivirus alert that reports an exploitation framework.
This event must not be ignored just because the AV has blocked the malware but investigate, how it came there in the first place.
Author: Florian Roth
· 2025-01-18 · logsource: product=linux category=process_creation · 297241f3-8108-4b3a-8c15-2dda9f844594
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Author: Sittikorn S, frack113
· 2021-07-16 (modified 2023-08-17) · logsource: product=windows category=registry_set · 32b5db62-cb5f-4266-9639-0fa48376ac00
Detects patterns as noticed in exploitation of Windows CVE-2021-31979 CVE-2021-33771 vulnerability and DevilsTongue malware by threat group Sourgum
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-03-12) · logsource: product=windows category=network_connection · 3c21219b-49b5-4268-bce6-c914ed50f09c
Detects network connections from "dfsvc.exe" used to handled ClickOnce applications to non-local IPs
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-20 · logsource: category=webserver · 41956f7c-7a6b-46d6-b6bb-da6eb2e83fbe
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0.
CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass,
which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through
template injection. This sequence enables unauthenticated remote code execution, significantly increasing
the impact of exploitation.
Author: Huntress Labs, Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-10-31 · logsource: product=windows category=process_creation · 43259cc4-1b80-4931-bd98-baea01afc196
Detects the creation of command-line interpreters (cmd.exe, powershell.exe) as child processes of Windows Server Update Services (WSUS) related process wsusservice.exe.
This behavior is a key indicator of exploitation for the critical remote code execution vulnerability such as CVE-2025-59287, where attackers spawn shells to conduct reconnaissance and further post-exploitation activities.
Author: Florian Roth (Nextron Systems), Zach Mathis
· 2020-01-15 (modified 2022-10-22) · logsource: product=windows service=application · 48d91a3a-2363-43ba-a456-ca71ac3da5c2
Detects events generated by user-mode applications when they call the CveEventWrite API when a known vulnerability is trying to be exploited.
MS started using this log in Jan. 2020 with CVE-2020-0601 (a Windows CryptoAPI vulnerability.
Unfortunately, that is about the only instance of CVEs being written to this log.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-06-12 (modified 2024-01-31) · logsource: product=windows category=network_connection · 4c5fba4a-9ef6-4f16-823d-606246054741
Detects an initiated network connection over uncommon ports from "dfsvc.exe". A utility used to handled ClickOnce applications.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-11-25 · logsource: product=windows category=process_creation · 5299fadf-f228-4526-8274-251db1960be9
Detects the execution of `bun_environment.js` via the Bun runtime, a behavior associated with the Shai-Hulud "Second Coming" NPM supply chain attack.
The malware uses a `setup_bun.js` script to install the Bun runtime if not present, and then executes the malicious `bun_environment.js` payload.
All 35 rules on the technique page →
T1497 Virtualization/Sandbox Evasion secondary impact
- DET0046 Detection Strategy for T1497 Virtualization/Sandbox Evasion
AN0127 WindowsExecution of discovery commands or API calls for virtualization artifacts (e.g., registry keys, device drivers, services), sleep/skipped execution behavior, or sandbox evasion DLLs before payload deployment.Tunable:
TimeWindowKnownVMArtifactListAN0128 LinuxExecution of commands to enumerate virtualization-related files or processes (e.g., '/sys/class/dmi/id/product_name', dmesg, lscpu, lspci), or querying hypervisor interfaces prior to malware execution.auditd:SYSCALLexecve or syscall invoking vm artifact check commands (e.g., dmidecode, lspci, dmesg)→ DC0032 Process Creationauditd:SYSCALLsleep function usage or loops (nanosleep, usleep) in scripts→ DC0064 Command ExecutionTunable:TimeWindowCommandArtifactMatchListAN0129 macOSExecution of scripts or binaries that check for virtualization indicators (e.g., system_profiler, ioreg -l, kextstat), combined with delay functions or anomalous launchd activity.macos:unifiedlogexecution of system_profiler, ioreg, kextstat with argument patterns related to VM/sandbox checks→ DC0032 Process Creationmacos:unifiedlogdynamic loading of sleep-related functions or sandbox detection libraries→ DC0016 Module LoadTunable:ProcessCommandPatternSleepThreshold
Sigma rules tagged attack.t1497 (0)
None. MITRE's strategy above is the only public detection guidance for this technique.
T1548 Abuse Elevation Control Mechanism primary impact
- DET0345 Detection Strategy for Abuse Elevation Control Mechanism (T1548)
AN0975 WindowsCorrelate registry modifications (e.g., UAC bypass registry keys), unusual parent-child process relationships (e.g., control.exe spawning cmd.exe), and unsigned elevated process executions with non-standard tokens or elevation flags.Tunable:
ElevatedProcessPathParentProcessNameTimeWindowAN0976 LinuxMonitor audit logs for setuid/setgid bit changes, executions where UID ≠ EUID (indicative of sudo or privilege escalation), and high-integrity binaries launched by unprivileged users.Tunable:WatchedDirectoriesUserContextTimeWindowAN0977 macOSDetect execution of/usr/libexec/security_authtrampolineor use of AuthorizationExecuteWithPrivileges API, and monitor process lineage for unusual launches of GUI apps with escalated privileges.Tunable:WatchedBinariesExecutionParentAN0978 Identity ProviderMonitor for unexpected privilege elevation operations via SAML assertion manipulation, role injection, or changes to identity mappings that result in access escalation.Tunable:AuthorizedRoleMappingsTimeWindowAN0979 IaaSDetect sudden privilege escalations such as IAM role changes, user-assigned privilege boundaries, or elevation via assumed roles beyond normal behavior.Tunable:PermittedRoleTransitionsCrossAccountBoundary
Sigma rules tagged attack.t1548 (24)
Author: Sittikorn S, Teoderick Contreras
· 2022-01-20 (modified 2022-12-31) · logsource: product=linux category=file_event · 00eee2a5-fdb0-4746-a21d-e43fbdea5681
Detects the creation of doas.conf file in linux host platform.
Author: Sittikorn S, Teoderick Contreras
· 2022-01-20 · logsource: product=linux category=process_creation · 067d8238-7127-451c-a9ec-fa78045b618b
Detects the doas tool execution in linux host platform. This utility tool allow standard users to perform tasks as root, the same way sudo does.
Author: Omkar Gudhate
· 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Author: Corissa Koopmans, '@corissalea'
· 2022-07-18 · logsource: product=azure service=auditlogs · 0922467f-db53-4348-b7bf-dee8d0d348c6
Monitor and alert on conditional access changes.
Author: Florent Labouyrie
· 2021-04-30 (modified 2022-10-09) · logsource: product=windows category=process_access · 174afcfa-6e40-4ae9-af64-496546389294
Detects when a process tries to access the memory of svchost to potentially dump credentials.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 · logsource: product=azure service=auditlogs · 26e7c5e2-6545-481e-b7e6-050143459635
Monitor and alert on conditional access changes where non approved actor removed CA Policy.
Author: Milad Cheraghi
· 2026-04-28 · logsource: product=linux category=process_creation · 33b3cfb1-574e-44b9-b527-fbf9303b9d7b
Detects attempts of an attacker to enable core dumps for set-user-ID (SUID) processes by modifying the system file /proc/sys/fs/suid_dumpable, typically by setting its value to 1 or 2.
Enabling this feature allows memory dumps (core dumps) of SUID processes, which usually run with elevated privileges.
These dumps may contain sensitive information such as passwords, cryptographic keys or other secrets.
CVE-2025-5054: Information leak via core dumps from SUID binaries using apport.
CVE-2025-4598: Information disclosure in systemd-coredump due to insecure handling of SUID process memory dumps.
Author: Luc Génaux
· 2026-01-24 · logsource: product=linux category=process_creation · 3a716279-c18c-4488-83be-f9ececbfb9fc
Detects the use of the 'setcap' utility to set the 'setgid' capability (cap_setgid) on a binary file.
This capability allows a non privileged process to make arbitrary manipulations of group IDs (GIDs), including setting its current GID to a value that would otherwise be restricted (i.e. GID 0, the root group).
This behavior can be used by adversaries to backdoor a binary in order to escalate privileges again in the future if needed.
Author: Corissa Koopmans, '@corissalea'
· 2022-07-19 (modified 2024-05-28) · logsource: product=azure service=auditlogs · 50a3c7aa-ec29-44a4-92c1-fce229eef6fc
Monitor and alert on conditional access changes. Is Initiated by (actor) approved to make changes? Review Modified Properties and compare "old" vs "new" value.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 665e2d43-70dc-4ccc-9d27-026c9dd7ed9c
Monitor and alert on group membership removal of groups that have CA policy modification access
Author: Elastic, @SBousseaden
· 2022-04-27 (modified 2024-08-13) · logsource: product=windows service=security · 749c9f5e-b353-4b90-a9c1-05243357ca4b
Detects a suspicious local successful logon event where the Logon Package is Kerberos, the remote address is set to localhost, and the target user SID is the built-in local Administrator account.
This may indicate an attempt to leverage a Kerberos relay attack variant that can be used to elevate privilege locally from a domain joined limited user to local System privileges.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 76737c19-66ee-4c07-b65a-a03301d1573d
Detects the deployment of workloads that are deployed by using the break-glass flag to override Binary Authorization controls.
Author: Florian Roth (Nextron Systems)
· 2021-05-27 (modified 2022-10-09) · logsource: product=windows category=process_creation · 883835a7-df45-43e4-bf1d-4268768afda4
Detects a regedit started with TrustedInstaller privileges or by ProcessHacker.exe
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 905d389b-b853-46d0-9d3d-dea0d3a3cd49
Identifies the suspicious use of AssumeRole. Attackers could move laterally and escalate privileges.
Author: Mark Morowczynski '@markmorow', Thomas Detzner '@tdetzner'
· 2022-08-04 · logsource: product=azure service=auditlogs · 91c95675-1f27-46d0-bead-d1ae96b97cd3
Monitor and alert on group membership additions of groups that have CA policy modification access