Loading...
Skip to main content
GeekWala

GHSA-f87w-3j5w-v58p — Vulnerability in CefSharp.OffScreen —...

HIGH

CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows

Published April 12, 2025Updated April 12, 2025Source: osv

Summary

Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High) https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032

Advisory Timeline

  • First published April 12, 2025 (548 days ago).
  • Last revised April 12, 2025 — 0 days after initial publication.

Remediation

Upgrade to the fixed version using your package manager.

NuGet
Update CefSharp.OffScreen to 134.3.90 or later
dotnet add package CefSharp.OffScreen --version 134.3.90
NuGet
Update CefSharp.WinForms to 134.3.90 or later
dotnet add package CefSharp.WinForms --version 134.3.90
NuGet
Update CefSharp.OffScreen.NetCore to 134.3.90 or later
dotnet add package CefSharp.OffScreen.NetCore --version 134.3.90
NuGet
Update CefSharp.Wpf.NetCore to 134.3.90 or later
dotnet add package CefSharp.Wpf.NetCore --version 134.3.90
NuGet
Update CefSharp.WinForms.NetCore to 134.3.90 or later
dotnet add package CefSharp.WinForms.NetCore --version 134.3.90
NuGet
Update CefSharp.Wpf.HwndHost to 134.3.90 or later
dotnet add package CefSharp.Wpf.HwndHost --version 134.3.90
NuGet
Update CefSharp.Wpf to 134.3.90 or later
dotnet add package CefSharp.Wpf --version 134.3.90

After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.

Affected Packages (7)

Affects 1 ecosystem: nuget (7).

PackageEcosystemAffectedFixed In
CefSharp.OffScreen
nuget
100.0.120-pre, 100.0.140, 100.0.230, 101.0.150 (+188 more)134.3.90
CefSharp.WinForms
nuget
1.25.3, 100.0.120-pre, 100.0.140, 100.0.230 (+193 more)134.3.90
CefSharp.OffScreen.NetCore
nuget
100.0.120-pre, 100.0.140, 100.0.230, 101.0.150 (+106 more)134.3.90
CefSharp.Wpf.NetCore
nuget
100.0.120-pre, 100.0.140, 100.0.230, 101.0.150 (+106 more)134.3.90
CefSharp.WinForms.NetCore
nuget
100.0.120-pre, 100.0.140, 100.0.230, 101.0.150 (+106 more)134.3.90
CefSharp.Wpf.HwndHost
nuget
100.0.140, 101.0.150, 101.0.180, 102.0.90 (+77 more)134.3.90
CefSharp.Wpf
nuget
1.25.2-perlun0, 1.25.3, 1.25.4, 1.25.5 (+201 more)134.3.90

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.3 score means for each attack dimension.

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
Required
Scope
Changed
Confidentiality
High
Integrity
High
Availability
High

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

References

Frequently Asked Questions

What is GHSA-f87w-3j5w-v58p?
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.3/10).
How do I check if my project is affected by GHSA-f87w-3j5w-v58p?
GHSA-f87w-3j5w-v58p affects CefSharp.OffScreen, CefSharp.WinForms and CefSharp.OffScreen.NetCore (and 4 more). Use GeekWala's free vulnerability scanner to check your dependencies against GHSA-f87w-3j5w-v58p and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score
8.3

High exploitability or significant impact. Prioritize remediation within days.

Related CVEs

More NuGet advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies