After Chrome patches zero-day used to target Russians, Firefox splats similar bug
- Reference: 1743143651
- News link: https://www.theregister.co.uk/2025/03/28/google_kaspersky_mozilla/
- Source link:
Now Mozilla's doing damage control, too, after spotting a similar flaw – albeit unexploited, as far as we're aware – lurking in the code of its Firefox browser.
The Chrome patch addresses a fairly vague vulnerability identified by Kaspersky, which it found after spotting a phishing campaign targeting Russian journalists, academics, and government agencies with bogus invites to an event. Victims who clicked the malicious link in an email didn't need to do anything else - the exploit immediately punched through [1]Chrome's security sandbox , which among other things keeps webpage tabs and plugins isolated from each other, potentially leading to further exploitation that hasn't yet been documented publicly.
[2]
"The vulnerability [3]CVE-2025-2783 really left us scratching our heads, as, without doing anything obviously malicious or forbidden, it allowed the attackers to bypass Google Chrome’s sandbox protection as if it didn’t even exist," [4]wrote Kaspersky researchers Igor Kuznetsov and Boris Larin.
[5]
[6]
The Kaspersky duo said they did not themselves observe subsequent malware infections, but believe the exploit “was designed to run in conjunction with an additional exploit that enables remote code execution.”
Phishing op targets anti-war Russians
Malware targeting Russians is unusual, but on Thursday security shop Silent Push [7]reported some it believes is used by Russian intelligence or a miscreant with similar motives to catch locals who oppose the illegal invasion of Ukraine.
The phishing sites impersonate organizations including the CIA, the Russian Volunteer Corps (a group of Russians in Ukraine fighting against Putin), a similar group Legion Liberty, and Hochu Zhit (translation: I want to live), a Ukrainian helpline established to assist Russian soldiers who wish to surrender.
The fake pages all share a common coding pattern and are designed to fool the target into submitting their personal information. We imagine that those who do so receive a visit from Russian Полици (police).
Google thanked the Kaspersky researchers for quietly tipping the biz off, and updated Chrome, explaining that the issue was caused by an "incorrect handle provided in unspecified circumstances in Mojo on Windows." [8]Mojo , in this case, refers to Chromium's internal inter-process communication (IPC) framework.
Mozilla decided to have a look at its own sandbox, and on Thursday pushed out its own fix after Firefox engineers found a similar flaw in their own IPC plumbing. That hole, now tracked as CVE-2025-2857, also allowed sandbox escapes on Windows.
"Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our inter-process communication (IPC) code," Mozilla [9]advised .
[10]
"Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape," the org said, referring to the original Chrome hole.
Given that Google's Chromium framework powers browsers like Edge, Opera, and Brave, users of those apps should expect similar patches to land soon - assuming they haven't already. Meanwhile, the Tor browser, built on Mozilla's open source Firefox project, on Thursday issued a [11]Windows-only emergency release with urgent security fixes. ®
Get our [12]Tech Resources
[1] https://chromium.googlesource.com/chromium/src/+/main/docs/design/sandbox.md
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2Z-aBOr78DptGa6HoSTOc6QAAABg&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://nvd.nist.gov/vuln/detail/CVE-2025-2783
[4] https://securelist.com/operation-forumtroll/115989/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-aBOr78DptGa6HoSTOc6QAAABg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33Z-aBOr78DptGa6HoSTOc6QAAABg&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.silentpush.com/blog/russian-intelligence-phishing/
[8] https://chromium.googlesource.com/chromium/src/+/main/mojo/README.md
[9] https://www.mozilla.org/en-US/security/advisories/mfsa2025-19/#CVE-2025-2857
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44Z-aBOr78DptGa6HoSTOc6QAAABg&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[11] https://blog.torproject.org/new-release-tor-browser-1408/
[12] https://whitepapers.theregister.com/
Re: Web browser = a shitty operating system?
When did browsers become OSs? With IPC and the like?
When they started to run arbitrary code that could initiate network data transfers without user intervention.
Re: Web browser = a shitty operating system?
"When did browsers become OSs? With IPC and the like?"
A long time ago.
You can actually [1]run linux inside your browser . And there is a choice in distributions of [2]JSlinux .
[3]More info , eg, that JSlinux includes Windows 2000 system for running old Windows programs and here you can directly [4]boot into a terminal
[1] https://www.technotification.com/2025/01/jslinux-free-online-linux-terminal-and-emulator.html
[2] https://bellard.org/jslinux/
[3] https://ostechnix.com/run-linux-operating-systems-browser/
[4] https://www.jslinux.org/
Roll your own - take the long road etc
If you want to ensure things like this aren't in your browser / software then you need to roll your own.
I'm not suggesting its easy, just that if your at risk of exploitation then the only way to be sure is to have your own guys write your own software & understand all the bits that go into it and conduct regular audits for bugs etc etc etc.
younguns wont believe it but in the dim distant past it was common for companies, agencies councils etc to have their own software departments that would write code in addition to purchasing off the shelf stuff.
likely need a return to those principles.
Re: Roll your own - or run Dillo
Or, you can run [1]Dillo , a JavaScript free browser.
You need to set up a HTTP proxy, though. I used a [2]HTTPTunnelPort through Tor .
[1] https://dillo.org/
[2] https://scrapfly.io/blog/how-to-use-tor-for-web-scraping/
Re: Roll your own - take the long road etc
I am afraid that if you try to roll your own browser, you will have to do work that is equivalent to writing your own OS. Also, the HTTP/HTTPS and HTML "standards" are almost impossible to implement.
What you can do, is using text-mode browsers. There are quite a number of them. Or, use curl for downloading the web pages and then, somehow, "render" them.
Engineered in?
A hole that you can trigger by doing nothing obviously bad, and that punches straight out of the sandbox sounds less like a bug and more like a carefully designed 'feature' quietly inserted by a TLA. The combination of an innocuous trigger & a significant effect are pretty classic signs.
Web browser = a shitty operating system?
There was a joke that all software devolve into being able to act as an email client.
When did browsers become OSs? With IPC and the like?