After Chrome patches zero-day used to target Russians, Firefox splats similar bug

Google pushed out an emergency patch for Chrome on Windows this week to stop attackers exploiting a sandbox-breaking zero-day vulnerability, seemingly used by snoops to target certain folks in Russia. Now Mozilla's doing damage control, too, after spotting a similar flaw – albeit unexploited, as far as we're aware – lurking in the code of its Firefox browser. The Chrome patch addresses a fairly vague vulnerability identified by Kaspersky, which it found after spotting a phishing campaign targeting Russian journalists, academics, and government agencies with bogus invites to an event. Victims who clicked the malicious link in an email didn't need to do anything else - the exploit immediately punched through Chrome's security sandbox, which among other things keeps webpage tabs and plugins isolated from each other, potentially leading to further exploitation that hasn't yet been documented publicly. "The vulnerability CVE-2025-2783 really left us scratching our heads, as, without doing anything obviously malicious or forbidden, it allowed the attackers to bypass Google Chrome’s sandbox protection as if it didn’t even exist," wrote Kaspersky researchers Igor Kuznetsov and Boris Larin. The Kaspersky duo said they did not themselves observe subsequent malware infections, but believe the exploit “was designed to run in conjunction with an additional exploit that enables remote code execution.” Malware targeting Russians is unusual, but on Thursday security shop Silent Push reported...