Russian Espionage Scheme Exposed: Google Patches Critical Chrome Vulnerability

At a glance

• Zero-Day Patched: Google patched a Chrome zero-day, CVE-2025-2783, after it was used in a targeted espionage campaign.
• Who Was Targeted: Kaspersky said the campaign, which it called Operation ForumTroll, went after media outlets, educational institutions and government organizations in Russia.
• Global Implications: The flaw let attackers escape Chrome’s sandbox on Windows, so every Chrome user on Windows needed the fix.
• What to Do: Update Chrome right away.

Google rushes a fix

Google has patched a high-severity zero-day vulnerability in Chrome, tracked as CVE-2025-2783, that was exploited in an espionage campaign. The fix shipped on March 25, 2025, in Chrome 134.0.6998.177/.178 for Windows. It was a sandbox escape.

Kaspersky researchers found the exploit while investigating a wave of phishing emails that went out in mid-March, in which victims received personalized invitations that appeared to come from the organizers of the “Primakov Readings” forum, and simply clicking the link in Chrome was enough to infect a computer with no further action from the user.

What researchers found

Why the exploit stood out

Kaspersky described the exploit as technically sophisticated and said the attackers appeared to be a state-sponsored group, without naming a country.

Browser zero-days are prized. Vendors have to move fast.

Who needed the patch

Chrome has billions of users, so a flaw like this matters well beyond the original targets. Once a patch is public, other attackers can study it and try to build their own exploits.

Google released the fix shortly after Kaspersky reported the flaw. Mozilla later found and patched a similar sandbox issue in Firefox for Windows.

Update now

Update Chrome now. It updates itself, but the fix only takes effect after the browser restarts, so close every window and reopen it, or go to Settings, About Chrome and click Relaunch if an update is waiting.

Check for updates regularly and install security patches promptly.

What the attack shows

Browsers are prime targets for attackers. Expect more of this.

Google’s quick fix shows why fast patching matters. So does the research that found the bug in the first place.

Keeping browsers safe

Defenders and attackers keep trying to outdo each other. This campaign is a reminder that a single click can be enough.

Keep browsers updated. Treat unexpected invitations with suspicion, even when they look personal.

Frank Jones, CISSP

Frank Jones has loved computers from the age of 13. Frank got his hacking career started when he downloaded a war dialing program that he used to detect dial up modems in his hometown of Chicago. Frank Jones now works as a JAVA coder and cyber security researcher.