CVE-2025-4609

Published Aug 22, 2025

Last updated 2 months ago

Google Chrome

Mojo

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-4609 is a vulnerability in Google Chrome's Mojo Inter-Process Communication (IPC) system. The flaw stems from an incorrect handle provision under unspecified circumstances. This can allow a remote attacker to potentially perform a sandbox escape via a malicious file. The vulnerability lies within Chromium's IPC mechanism, ipcz, potentially allowing a compromised renderer process to gain privileged browser process handles. Exploiting this flaw could allow an attacker to elevate the renderer's privileges and execute commands on the victim's machine.

Description: Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 136.0.7103.113 allowed a remote attacker to potentially perform a sandbox escape via a malicious file. (Chromium security severity: High)
Source: chrome-cve-admin@google.com
NVD status: Analyzed
Products: chrome

Risk scores

CVSS 3.1

Type: Secondary
Base score: 9.6
Impact score: 6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Severity: CRITICAL

Weaknesses

134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-732

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:google:chrome:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4A0348CA-E6CE-457D-8AAC-1E97E6E793A4",
            "versionEndExcluding": "136.0.7103.113"
          }
        ],
        "operator": "OR"
      },
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*",
            "vulnerable": false,
            "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"
          }
        ],
        "operator": "OR"
      }
    ],
    "operator": "AND"
  }
]

References

Sources include official advisories and independent security research.