Threat Hunting: Why Your Network Needs a Hunter, Not Just a Guard
Traditional security waits for a breach. Threat hunting goes looking for it. Learn why controlled paranoia is the healthiest strategy for your business.
Cybersecurity
Chrome Zero-Day Report 2025: What a Record Year of Exploited Vulnerabilities Says About Browser Security
Eight critical Chrome zero-days in one year. How APT groups weaponized the V8 engine, and why the sandbox alone is no longer enough in 2025.
Google Chrome Zero-Day Vulnerabilities in 2025: An Overview
In 2025, Google fought a steady battle against zero-day vulnerabilities in Chrome. Over the year it fixed eight critical vulnerabilities that attackers were already exploiting in the wild. Every one of them was rated high severity, with an average score of 8.5 on the CVSS scale.
Attackers were this active, including state-sponsored groups and companies that sell commercial surveillance tools, because Chrome is still the main target of advanced cyberattacks worldwide.
Vulnerabilities Discovered in 2025
The attacks focused on the browser's core components: the V8 JavaScript engine, the sandbox protections, and the graphics components. All of these incidents are listed in CISA's official catalog.
| CVE ID | Discovered | Component and Bug Type |
|---|---|---|
| CVE-2025-2783 | March | Sandbox escape |
| CVE-2025-4664 | May | Unauthorized account takeover |
| CVE-2025-5419 | June | Memory access bug in V8 |
| CVE-2025-6554 | July | V8 engine flaw |
| CVE-2025-6558 | July | Unspecified bug |
| CVE-2025-10585 | September | V8 type confusion |
| CVE-2025-13223 | November | V8 type confusion |
| CVE-2025-14174 | December | Vulnerability in the ANGLE module / GPU handling |
Key Technical Takeaways
1. V8 Engine Bugs Dominate
The V8 engine was the weakest link. Most of the flaws found there, such as CVE-2025-10585, were "type confusion" bugs. These let attackers trick the engine into misreading data, which ultimately lets them run malicious code remotely (RCE) on the user's computer.
2. Breaking Out of the Sandbox
The March vulnerability CVE-2025-2783 was especially dangerous. It let malware "escape" the browser's isolated environment and gain direct access to the operating system's files and functions.
3. Graphics and Communication Issues (ANGLE/Mojo)
Toward the end of the year, attackers turned their attention to the ANGLE graphics layer and the Mojo IPC communication system. For example, CVE-2025-14174 allowed attackers to manipulate the memory of the processes that render images on screen.
Who Is Behind the Attacks?
Experts point to two main groups of threat actors:
- APT groups (Advanced Persistent Threat: groups of attackers that carry out sophisticated, long-term operations): Advanced hacking groups working on behalf of governments.
- Spyware vendors: Private companies that build surveillance tools for intelligence and security agencies.
In the high-profile "ForumTroll" operation, attackers used a Chrome vulnerability to infect their targets with the advanced LeetAgent trojan.
Case Study: Operation ForumTroll (March 2025)
Operation ForumTroll was one of the most sophisticated espionage campaigns of 2025, and it showed in practice how powerful CVE-2025-2783 was. The attack, attributed to state-backed APT groups, targeted educational institutions and media organizations and used an unusual approach to exploiting systems.
How the Attack Worked: When the Sandbox Stops Existing
The most dangerous part of the operation was its ability to bypass Chrome's protections completely. Researchers at K7 Security Labs reported that a logic flaw at the boundary between Chrome and Windows let the attackers escape the browser sandbox "as if it didn't exist at all."
The infection had two stages:
- Escape: Exploiting CVE-2025-2783 to break out of the isolated environment (the sandbox).
- Privilege Escalation: Running a second exploit that allowed remote code execution (RCE) with the highest system privileges (System-level privileges).
Targeted Phishing and Strong OpSec
The attackers took great care with operational security (OpSec) to avoid detection by monitoring systems:
- Personalization: Victims received carefully crafted invitations to the "Primakov Readings" forum (domain
primakovreadings[.]info). - Short lifespan: The phishing links were live for only a very short time, so automated security scanners could not analyze them.
- Zero-Interaction: Once the victim clicked the link, the infection ran automatically, with no further action needed from the user.
The Goal: Deep Surveillance
The main purpose of the deployed malware (detected under names including Trojan.Win64.Agent) was to steal sensitive information. The malware:
- Stole data: It collected documents, browser credentials, and all email correspondence.
- Ensured persistence: It created scheduled tasks and modified the system registry to survive a reboot.
- Concealed its communications: It used custom obfuscation techniques and encrypted C2 (Command & Control) channels.
Protection status: Google patched this vulnerability on March 25, 2025, in Chrome version 134.0.6998.177/.178. The incident remains a strong argument for deploying remote browser isolation (RBI) in critical infrastructure.
Conclusions and Security Recommendations
Google keeps adding new protections such as MiraclePtr, but Chrome is so widely used that it remains an attractive target.
Recommendations for organizations:
- Remote browser isolation (RBI): Move web browsing into a secure cloud environment.
- Prioritized updates: Install Chrome patches as soon as they are released.
- Network monitoring: Use IDS/IPS systems to detect suspicious behavior in web traffic.
