Operation ForumTroll is the name a single vendor research report gave to a 2025 phishing campaign that used a Chrome zero-day, CVE-2025-2783. No government agency has confirmed the campaign or who ran it. What is confirmed is the flaw: Google fixed it in Chrome 134.0.6998.177 for Windows, the NVD records it, and CISA lists it as exploited.
This page keeps to what those primary sources state. Anything about the people behind the name, their targets or their goals comes from that one report and is treated here as unconfirmed.
What do primary sources confirm about the Operation ForumTroll Chrome flaw?
- Flaw.
- Incorrect handle provided in unspecified circumstances in Mojo in Google Chrome on Windows (NVD).
- Effect.
- A remote attacker could perform a sandbox escape via a malicious file (NVD).
- Fixed in.
- Chrome 134.0.6998.177 and .178 for Windows, stable channel update of 25 March 2025 (Chrome Releases).
- Severity.
- High by the Chromium project; CVSS 3.1 base score 8.3 High in the NVD record.
- CISA KEV.
- Added 27 March 2025, remediation due 17 April 2025 for federal agencies (NVD record of the CISA entry).
- Published in NVD.
- 26 March 2025.
Google’s Chrome Releases notice of 25 March 2025 lists the fix as a High severity item and credits external researchers who reported it on 20 March 2025. The NVD entry carries CISA’s Known Exploited Vulnerabilities data, which is the government confirmation that the flaw has been used in real attacks.
What is not confirmed about Operation ForumTroll?
Public reporting that uses the name describes a phishing campaign in 2025 in which a link led to the Chrome flaw. Only the flaw itself is backed by NVD, Google and CISA. The attacker’s identity, any state link, the list of victims and the motive are not confirmed by any government or product-owner source, so this page does not state them.
An earlier version of this page described ForumTroll as a pro-Russian influence operation against Eastern Europe, run through forum personas. No NVD, Google or CISA source supports that account, so it has been removed.
How does a Chrome sandbox escape help an attacker?
Chrome runs web content inside a restricted sandbox, so a flaw in page code alone usually cannot touch the rest of the computer. A sandbox escape such as CVE-2025-2783 lets an attacker step out of that restriction. The NVD record says the escape was possible on Windows through a malicious file, and that Chrome versions before 134.0.6998.177 were affected.
- DeliveryA victim on Windows is led to attacker-controlled content in Chrome.Technique T1566 (MITRE ATT&CK, opens in a new tab)
- Sandbox escapeThe Mojo handle flaw lets the attacker leave the browser sandbox.
- Next stepsWhat follows is not described by NVD, Google or CISA.
Phishing is the delivery route the single report describes. MITRE ATT&CK defines phishing (T1566) as electronically delivered social engineering. The delivery detail for this campaign is not confirmed by a primary source.
How should organizations respond to CVE-2025-2783?
- Update ChromeMove Windows systems to Chrome 134.0.6998.177 or later and check Extended stable is on .178 or later.
- Treat it as exploitedCISA lists it in the KEV catalog, so patch it ahead of flaws with no known exploitation.
- Turn on automatic updatesChrome fixes only protect users who restart the browser after the update.
- Check your inventoryFind unmanaged or offline Windows machines that still run an older Chrome.
- Train staff on linksPhishing is the reported delivery route, so remind staff to treat unexpected links with care.
The remediation due date of 17 April 2025 applies to US federal agencies under CISA’s catalog rules. Other organizations can use it as a sensible target, and the same fix applies to every Windows Chrome install.
Where do the sources differ?
Sources differ on what Operation ForumTroll is. The single report ties the name to a phishing campaign that used this Chrome flaw, while NVD, Google and CISA describe only the flaw and its exploitation. If a government advisory later names the campaign, this page will be updated to match it.
