CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
Priority LOW 38Published · Updated
Key facts
- Attack vector
- —
- Privileges required
- —
- User interaction
- —
- Attack complexity
- —
- Impact type
- —
- Confidentiality · integrity · availability
- —
- Fix status
- Fixed
No CVSS vector from any source. Fix status from GitHub.
Summary
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032
Why it matters now
Fix Fixed CefSharp.Wpf (NuGet): 134.3.90CefSharp.Wpf.HwndHost (NuGet): 134.3.90+5 more products
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | CefSharp.Wpf (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
| — | CefSharp.Wpf.HwndHost (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
| — | CefSharp.Wpf.NetCore (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
| — | CefSharp.WinForms (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
| — | CefSharp.WinForms.NetCore (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
| — | CefSharp.OffScreen.NetCore (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
| — | CefSharp.OffScreen (NuGet) | before 134.3.90 | 134.3.90 | Patch available | GHSA-f87w-3j5w-v58p |
- CefSharp.Wpf (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
- CefSharp.Wpf.HwndHost (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
- CefSharp.Wpf.NetCore (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
- CefSharp.WinForms (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
- CefSharp.WinForms.NetCore (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
- CefSharp.OffScreen.NetCore (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
- CefSharp.OffScreen (NuGet) Vendor— Affected before 134.3.90 Fixed in 134.3.90 Patch available GHSA-f87w-3j5w-v58p
Remediation
- Fix · GHSA-f87w-3j5w-v58p CefSharp.Wpf (NuGet) Fixed in 134.3.90 Advisory →
- Fix · GHSA-f87w-3j5w-v58p CefSharp.Wpf.HwndHost (NuGet) Fixed in 134.3.90 Advisory →
- Fix · GHSA-f87w-3j5w-v58p CefSharp.Wpf.NetCore (NuGet) Fixed in 134.3.90 Advisory →
- Fix · GHSA-f87w-3j5w-v58p CefSharp.WinForms (NuGet) Fixed in 134.3.90 Advisory →
- Fix · GHSA-f87w-3j5w-v58p CefSharp.WinForms.NetCore (NuGet) Fixed in 134.3.90 Advisory →
- Fix · GHSA-f87w-3j5w-v58p CefSharp.OffScreen.NetCore (NuGet) Fixed in 134.3.90 Advisory →
- Fix · GHSA-f87w-3j5w-v58p CefSharp.OffScreen (NuGet) Fixed in 134.3.90 Advisory →
Timeline
- 2026-10-03 Threatist record created from GHSA-f87w-3j5w-v58p
References
Other 5
- https://github.com/cefsharp/CefSharp/security/advisories/GHSA-f87w-3j5w-v58p
- https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html
- https://github.com/cefsharp/CefSharp
- https://github.com/cefsharp/CefSharp/releases/tag/v134.3.90
- https://issues.chromium.org/issues/405143032
Sources
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences