GHSA-f87w-3j5w-v58p CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
Remote attackers can escape the sandbox and execute code via a malicious file in CefSharp on Windows.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is GHSA-f87w-3j5w-v58p?
GHSA-f87w-3j5w-v58p is a vulnerability in CefSharp.OffScreen, published on 12 Apr 2025. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032
Which versions are affected by GHSA-f87w-3j5w-v58p?
14 open source packages ship an affected version, including CefSharp.OffScreen, CefSharp.OffScreen.NetCore and CefSharp.WinForms.
| Package | Affected | Fixed in |
|---|---|---|
CefSharp.OffScreen NuGet | All versions | 134.3.90 |
CefSharp.OffScreen NuGet | All versions | 134.3.90 |
CefSharp.OffScreen.NetCore NuGet | All versions | 134.3.90 |
CefSharp.OffScreen.NetCore NuGet | All versions | 134.3.90 |
CefSharp.WinForms NuGet | All versions | 134.3.90 |
CefSharp.WinForms NuGet | All versions | 134.3.90 |
8 more packages
CefSharp.WinForms.NetCore NuGet | All versions | 134.3.90 |
CefSharp.WinForms.NetCore NuGet | All versions | 134.3.90 |
CefSharp.Wpf NuGet | All versions | 134.3.90 |
CefSharp.Wpf NuGet | All versions | 134.3.90 |
CefSharp.Wpf.HwndHost NuGet | All versions | 134.3.90 |
CefSharp.Wpf.HwndHost NuGet | All versions | 134.3.90 |
CefSharp.Wpf.NetCore NuGet | All versions | 134.3.90 |
CefSharp.Wpf.NetCore NuGet | All versions | 134.3.90 |
How do I fix GHSA-f87w-3j5w-v58p?
Upgrade CefSharp.OffScreen to 134.3.90 or later.
Is GHSA-f87w-3j5w-v58p being exploited?
There is no known exploitation of GHSA-f87w-3j5w-v58p in the wild and no public exploit code.