HIGH8.3
GHSA-f87w-3j5w-v58p
CefSharp affected by incorrect handle provided in unspecified circumstances in Mojo on Windows
Quick fix
GHSA-f87w-3j5w-v58p — CefSharp.Wpf: upgrade to the fixed version with the command below.
dotnet add package CefSharp.Wpf --version 134.3.90Details
Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows prior to 134.0.6998.177 allowed a remote attacker to perform a sandbox escape via a malicious file. (Chromium security severity: High)
https://nvd.nist.gov/vuln/detail/CVE-2025-2783 https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html https://issues.chromium.org/issues/405143032
Are you affected?
Enter the version of the package you're using.
Affected packages
NuGet/CefSharp.Wpf
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.Wpf --version 134.3.90NuGet/CefSharp.Wpf.HwndHost
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.Wpf.HwndHost --version 134.3.90NuGet/CefSharp.Wpf.NetCore
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.Wpf.NetCore --version 134.3.90NuGet/CefSharp.WinForms
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.WinForms --version 134.3.90NuGet/CefSharp.WinForms.NetCore
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.WinForms.NetCore --version 134.3.90NuGet/CefSharp.OffScreen.NetCore
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.OffScreen.NetCore --version 134.3.90NuGet/CefSharp.OffScreen
Introduced in:
0Fixed in: 134.3.90Fix
dotnet add package CefSharp.OffScreen --version 134.3.90References
- https://github.com/cefsharp/CefSharp/security/advisories/GHSA-f87w-3j5w-v58p[WEB]
- https://nvd.nist.gov/vuln/detail/CVE-2025-2783[ADVISORY]
- https://chromereleases.googleblog.com/2025/03/stable-channel-update-for-desktop_25.html[WEB]
- https://github.com/cefsharp/CefSharp[PACKAGE]
- https://github.com/cefsharp/CefSharp/releases/tag/v134.3.90[WEB]
- https://issues.chromium.org/issues/405143032[WEB]