Archive — US — techcrunch
Google fixes Chrome zero-day security flaw used in hacking campaign targetingjournalists
Google has patched a Chrome zero-day vulnerability (CVE-2025-2783) exploited in a hacking campaign targeting journalists. Discovered by Kaspersky, the flaw allowed attackers to bypass Chrome's security, exploiting phishing links to compromise users' computers. It is likely tied to a state-sponsored group, highlighting the ongoing risks associated with zero-day vulnerabilities.
Key points
- Google fixed a zero-day vulnerability in Chrome (CVE-2025-2783) used for hacking.
- The flaw was discovered by Kaspersky and enabled bypassing of Chrome's sandbox security.
- The hacking campaign, dubbed 'Operation ForumTroll,' targeted journalists with phishing emails about a Russian political summit.
- Clicking a malicious link allowed hackers to gain access to victims' data.
- The attackers are believed to be part of a state-sponsored group.
- The bug affects all browsers based on Google's Chromium engine.
Why it matters
- The incident underscores the rising threat from advanced persistent threats (APTs), particularly from state-sponsored hackers.
- Zero-day vulnerabilities are increasingly valuable, with reports indicating they can sell for millions.
- The event aligns with broader trends in cyber security, emphasizing the need for continuous updates and vigilance among software providers.
This incident highlights the urgency for rapid response measures in cybersecurity to protect users against sophisticated cyber threats, especially in the current climate of increased state-sponsored cyber activities.