CVE-2025-4609: Google Chrome RCE Vulnerability

CVE-2025-4609 Overview

CVE-2025-4609 affects Google Chrome on Windows versions prior to 136.0.7103.113. The flaw resides in Mojo, Chrome's inter-process communication (IPC) framework, which incorrectly provides a handle under unspecified circumstances. A remote attacker can leverage this weakness via a malicious file to potentially escape the Chrome sandbox. The vulnerability is classified under CWE-732: Incorrect Permission Assignment for Critical Resource. Google rated the Chromium security severity as High, and the CVSS 3.1 base score is 9.6, reflecting the impact of a successful sandbox escape on Chrome users.

Critical Impact

A successful exploit allows a remote attacker to escape the Chrome renderer sandbox on Windows, enabling code execution outside browser isolation boundaries.

Affected Products

• Google Chrome on Windows prior to 136.0.7103.113
• Microsoft Windows host platform running affected Chrome builds
• Chromium-based browsers incorporating the unpatched Mojo IPC code

Discovery Timeline

• 2025-08-22 - CVE-2025-4609 published to the National Vulnerability Database
• 2025-08-25 - Last updated in NVD database

Technical Details for CVE-2025-4609

Vulnerability Analysis

The vulnerability resides in Mojo, the Chromium IPC system that brokers messages and resource handles between sandboxed renderer processes and the privileged browser process. Under unspecified conditions, Mojo provides an incorrect handle to a recipient process. Because Windows handles convey access rights to kernel objects such as processes, files, and sections, an incorrect handle granted to a lower-privileged process can break the security boundary Chrome relies on for isolation. The result is a potential sandbox escape, which transforms a contained renderer compromise into code execution at the privilege level of the receiving process. User interaction is required because the exploit chain is triggered through a malicious file.

Root Cause

The root cause is an incorrect permission assignment for a critical resource [CWE-732]. Mojo passes a handle whose rights or target context do not match the security model the sandbox depends on. This handle confusion permits operations that the sandboxed process should not be able to perform.

Attack Vector

The attack vector is network-based and requires user interaction. An attacker hosts or delivers a malicious file that, when processed by Chrome, drives the Mojo IPC code path responsible for issuing the incorrect handle. After the renderer obtains the handle, the attacker chains it to perform actions outside the sandbox. No code examples are published by the vendor. Refer to the Chromium Issue Tracker Entry and the Google Chrome Update Notification for upstream technical context.

Detection Methods for CVE-2025-4609

Indicators of Compromise

• Chrome renderer processes (chrome.exe --type=renderer) spawning unexpected child processes or writing to user-writable paths outside the browser cache.
• Anomalous handle duplication or DuplicateHandle activity originating from sandboxed Chrome renderers targeting the browser broker process.
• Delivery of unsolicited files that are opened or processed by Chrome immediately before suspicious process behavior on the host.

Detection Strategies

• Inventory Chrome installations and alert on any Windows endpoint running a Chrome version below 136.0.7103.113.
• Hunt for renderer-to-broker IPC anomalies and post-exploitation behaviors such as token manipulation or persistence written by Chrome child processes.
• Correlate browser download events with subsequent process creation chains that deviate from baseline Chrome behavior.

Monitoring Recommendations

• Ingest Windows process creation, image load, and handle audit events into a centralized analytics platform for behavioral correlation.
• Monitor Chrome auto-update telemetry and group policy reporting to confirm fleet-wide deployment of the fixed build.
• Track outbound connections from Chrome to newly registered or low-reputation domains that distribute the malicious file triggering the flaw.

How to Mitigate CVE-2025-4609

Immediate Actions Required

• Update Google Chrome on all Windows endpoints to 136.0.7103.113 or later and restart the browser to load the patched binaries.
• Audit managed Chromium-based browsers (Edge, Brave, Opera, Vivaldi) for vendor builds that incorporate the upstream Mojo fix.
• Restrict execution of untrusted files delivered through email, chat, or web downloads until patch coverage is verified.

Patch Information

Google released the fix in the Stable channel update documented at the Google Chrome Update Notification. Windows users must run Chrome 136.0.7103.113 or later. Enterprises should validate distribution through their patch management workflow and confirm relaunch on user endpoints, since Chrome does not apply pending updates until the browser is restarted.

Workarounds

• Enforce Chrome auto-update via the AutoUpdateCheckPeriodMinutes and RelaunchNotification enterprise policies to minimize patch latency.
• Disable or restrict opening of untrusted file types in the browser, and route downloads through sandboxed analysis where feasible.
• Apply application allowlisting to prevent unsigned binaries spawned from Chrome renderer processes from executing.

# Verify installed Chrome version on Windows endpoints
reg query "HKLM\SOFTWARE\Wow6432Node\Google\Update\Clients\{8A69D345-D564-463C-AFF1-A69D9E530F96}" /v pv

# Force Chrome to check for updates immediately (run as the logged-on user)
"%ProgramFiles%\Google\Chrome\Application\chrome.exe" --check-for-update-interval=1