A proof-of-concept exploit for a high-severity Google Chrome zero-day vulnerability has been published publicly, less than three months after the flaw was first disclosed, amid reports of active in-the-wild exploitation. The vulnerability, tracked as CVE-2025-5419, stems from out-of-bounds reads and writes in Chrome’s V8 JavaScript engine, affecting versions prior to 137.0.7151.68 and opening the door […]
Cybersecurity researchers have identified a resurgence of SpyNote malware campaigns targeting Android users through sophisticated fake Google Play Store websites. The malicious actor behind these attacks has implemented new anti-analysis techniques and expanded their deceptive tactics since previous reports, demonstrating a persistent threat to mobile device security. Deceptive Campaign Hits Popular Apps The threat actor […]
Threat actors are increasingly refining Android droppers to circumvent enhanced security measures, extending their utility beyond sophisticated banking trojans to simpler malware variants like SMS stealers and basic spyware. Historically, droppers served as innocuous entry points for payloads requiring elevated permissions, such as Accessibility Services, particularly after Android 13’s API restrictions limited direct installations. These […]
The Cybersecurity and Infrastructure Security Agency (CISA) has issued an urgent alert regarding a critical vulnerability in Git (CVE-2025-48384) that enables arbitrary file writes and has already been observed in active exploitation campaigns. The flaw arises from Git’s inconsistent handling of carriage return characters (CR) in its configuration files, potentially allowing threat actors to execute […]
A critical Server-Side Request Forgery (SSRF) vulnerability has been discovered in the popular PhpSpreadsheet library, allowing attackers to inject malicious HTML input when processing spreadsheet documents. The vulnerability, assigned CVE-2025-54370, affects multiple versions of the phpoffice/phpspreadsheet package and carries a high severity rating with CVSS v3.1 score of 7.5 and CVSS v4.0 score of 8.7. Vulnerability Details The security flaw was discovered by Aleksey […]
Before a patch could be rolled out to all users, proof-of-concept (PoC) exploit code had been published, and active exploitation had been observed in targeted campaigns.
Key Takeaways 1. CVE-2025-5419 lets attackers exploit V8 OOB read/write for remote code execution. 2. Public PoC shows array backing‐store corruption and function‐pointer hijack; real‐world attacks reported. 3. Update Chrome, block exploit domains, or disable JIT on untrusted sites.
Security teams and administrators are urged to upgrade to Chrome 137.0.7151.68 or later immediately to mitigate ongoing attacks.
Out-of-Bounds (OOB) Flaw
CVE-2025-5419 is an out-of-bounds (OOB) read and write flaw in V8’s array handling routines.
An attacker can craft a malicious HTML page embedding specially structured JavaScript arrays that trigger heap corruption when parsed by the engine.
This corruption allows arbitrary read and write primitives within the renderer process, paving the way for remote code execution under the context of the logged-in user.
Exploit chains typically begin with the OOB primitive to leak addresses of critical V8 objects, then escalate to an arbitrary write to overwrite function pointers.
Once exploited, the attacker can drop a second-stage payload or deliver ransomware, keyloggers, or other malware.
Risk Factors
Details
Affected Products
Google Chrome prior to 137.0.7151.68
Impact
Arbitrary code execution
Exploit Prerequisites
Victim must visit a malicious webpage
CVSS 3.1 Score
9.8 (Critical)
PoC Exploit
A PoC script has been published by security researcher mistymntncop on GitHub. The key snippet demonstrating the OOB write appears as follows:
This code corrupts the backing store of arr, enabling controlled overwrites of adjacent memory. The PoC then leverages these primitives to hijack the V8 function dispatch table, achieving arbitrary code execution in the renderer.
Active exploitation in the wild has been reported, with targeted spear-phishing campaigns luring victims to compromised sites. Organizations should:
Ensure all endpoints run version 137.0.7151.68 or newer.
Block known exploit domains and monitor unusual V8 process behavior.
Look for JavaScript exceptions or suspicious heap layout anomalies.
Google’s official patch addresses the root cause by correcting the bounds check logic in V8’s array implementation.
With the rapid publication of PoC code and confirmed in-the-wild attacks, defenders must act swiftly to eliminate this high-severity threat.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
A critical security risk has emerged for Windows users of WhatsApp Desktop who also have Python installed. Attackers can exploit a flaw in how WhatsApp Desktop handles .pyz (Python archive) files, delivering arbitrary code execution on the victim’s machine with a single click. Researchers have discovered that a maliciously crafted .pyz file—normally used to bundle Python applications—can be disguised […]
Cyber threats and attacks like ransomware continue to increase in volume and complexity with the endpoint typically being the most sought after and valued target. With the rapid expansion and adoption of AI, it is more critical than ever to ensure the endpoint is adequately secured by a platform capable of not just keeping pace, but staying ahead of an ever-evolving threat landscape.
A new large-scale campaign has been observed exploiting over 100 compromised WordPress sites to direct site visitors to fake CAPTCHA verification pages that employ the ClickFix social engineering tactic to deliver information stealers, ransomware, and cryptocurrency miners.
The large-scale cybercrime campaign, first detected in August 2025, has been codenamed ShadowCaptcha by the Israel National
The cybersecurity landscape has been significantly impacted by the discovery and active exploitation of two critical zero-day vulnerabilities in WinRAR, one of the world’s most widely used file compression utilities.
CVE-2025-6218 and CVE-2025-8088 represent sophisticated attack vectors that have enabled threat actors to achieve remote code execution and establish persistent access to compromised systems through maliciously crafted archive files.
These vulnerabilities, with CVSS scores of 8.8 and 7.8, respectively, demonstrate the critical importance of maintaining updated compression software and implementing robust security measures around file handling processes.
The exploitation of these vulnerabilities has been observed across multiple threat campaigns, affecting both individual users and enterprise environments, highlighting the urgent need for comprehensive vulnerability management and user awareness programs.
WinRAR 0-Day Vulnerabilities
WinRAR, developed by win.rar GmbH, has maintained its position as a dominant force in the file compression software market for over two decades, with an estimated user base exceeding 500 million installations worldwide.
The software’s ubiquity across personal and corporate environments has made it an attractive target for cybercriminals seeking to exploit fundamental weaknesses in archive processing mechanisms.
The emergence of CVE-2025-6218 and CVE-2025-8088 represents a significant escalation in the sophistication of attacks targeting compression software, moving beyond traditional social engineering tactics to leverage deep technical vulnerabilities in the application’s core functionality.
The architectural design of WinRAR’s extraction engine, which processes complex archive structures and metadata, has historically presented numerous attack surfaces for malicious actors.
These vulnerabilities specifically target the filename parsing routines and path traversal protection mechanisms that are fundamental to secure archive extraction.
The discovery of these vulnerabilities coincided with increased threat actor interest in supply chain attacks and living-off-the-land techniques, making WinRAR an ideal vector for initial access and lateral movement within target networks.
Modern threat landscapes have demonstrated that compression software vulnerabilities can serve as powerful enablers for multi-stageattack campaigns, allowing adversaries to bypass traditional security controls while maintaining a low detection profile.
The integration of these exploits into advanced persistent threat (APT) toolkits and commodity malware families has amplified their impact, creating cascading security incidents across multiple industry sectors.
The technical complexity of these vulnerabilities also presents significant challenges for detection and mitigation, requiring organizations to implement comprehensive monitoring and response capabilities.
WinRAR Exploit Flow.
Technical Breakdown of the Vulnerabilities
CVE-2025-6218 represents a critical path traversal vulnerability within WinRAR’s archive extraction functionality, characterized by insufficient validation of file paths during the decompression process.
This vulnerability enables attackers to craft malicious RAR archives containing specially formatted filenames that canescape the intended extraction directory and write arbitrary files to sensitive system locations.
The vulnerability operates by exploiting weaknesses in the path normalization routines, allowing the use of directory traversal sequences (../) that bypass existing security controls and enable unauthorized file system access.
The technical implementation of CVE-2025-6218 centers around the manipulation of archive headers and filename entries that are processed during extraction.
Attackers leverage Unicode encoding techniques and null byte injectionto create filenames that appear legitimate to initial validation routines but are interpreted differently during the actual file creation process.
This discrepancy allows malicious files to be written to critical system directories such as the Windows startup folder, system32 directory, or user profile locations, enabling immediate or persistent code execution upon system restart or user login.
CVE-2025-8088 presents a complementary attack vector through a buffer overflow vulnerability in WinRAR’s filename parsing engine. This vulnerability occurs when the application processes archive entries with exceptionally long filenames or malformed Unicode sequences, causing memory corruption that can be leveraged to achieve arbitrary code execution.
The vulnerability manifests during the initial parsing phase of archive processing, before any user interaction or security warnings are displayed, making it particularly dangerous for automated extraction scenarios or when email security gateways process archives.
The exploitation mechanism for CVE-2025-8088 involves careful manipulation of heap memory structures and return-orientedprogramming (ROP) techniques to bypass modern memory protection mechanisms such as Address Space Layout Randomization (ASLR) and Data Execution Prevention (DEP).
Successful exploitation results in the attacker gaining the same privilege level as the WinRAR process, typically enabling full user-level access to the compromised system. When combined with CVE-2025-6218, these vulnerabilities create a powerful attack chain that provides both immediate code execution and persistent system access.
WinRAR CVE-2025-8088 via RAR file delivering a malicious LNK file.(Source: ESET)
The initial discovery of these vulnerabilities emerged from security research conducted by multiple independent security firms during routine analysis of file format handling in popular compression software.
The research methodology involved comprehensive fuzzing operations against WinRAR’s parsing engines, utilizing both mutation-based and generation-based fuzzing techniques to identify edge cases in filename processing and archive structure validation.
Initial indicators of the vulnerabilities surfaced when researchers observed abnormal memory consumption patterns and unexpected file system operations during controlled extraction tests.
The first confirmed exploitation attempts were detected in early 2025 through advanced threat detection platforms monitoring for unusual file system activities associated with archive extraction processes.
Threat intelligence analysts identified a correlation between suspiciousRAR file attachments in targeted phishing campaigns and subsequent indicators of compromise on victim systems.
These initial detections revealed a sophisticated attack infrastructure utilizing dynamic DNS services and compromised legitimate websites to host malicious archive files disguised as software updates, document collections, and media files.
Detailed forensic analysis of captured exploit samples revealed the technical sophistication employed by threat actors in weaponizing these vulnerabilities.
The malicious archives demonstrated advanced anti-analysis techniques, including the use of password protection, nestedarchive structures, and decoy files designed to evade automated security scanning systems.
Researchers discovered that successful exploitation campaigns employed social engineering themes related to current events, software updates, and business communications to increase the likelihood of user interaction with malicious archives.
The attack infrastructure supporting these exploitation campaigns exhibited characteristics consistent with organized cybercriminal operations, featuring redundant command and control networks, cryptocurrency-based payment systems, and sophisticated victim targeting mechanisms.
Analysis of network telemetry data revealed that successful compromises were followed by rapid lateral movement activities, credential harvesting operations, and deployment of secondary malware payloads designed to establish long-term persistence and facilitate data exfiltration.
Detection and Indicators of Compromise (IoCs)
Comprehensive detection of CVE-2025-6218 and CVE-2025-8088 exploitation requires implementation of multi-layered monitoring strategies that encompass file system operations, network communications, and process execution patterns.
Security teams should focus on detecting anomalous file creation activities outside standard application directories, particularly focusing on writes to system folders, startup locations, and user profile directories that occur during or immediately after archive extraction processes.
File integrity monitoring systems should be configured to alert on unexpected modifications to critical system files, especially DLL files in application directories that may indicate hijacking attempts.
Network-based detection mechanisms should monitor for unusual DNS queries and HTTP/HTTPS connections initiated shortly after archive file processing, particularly focusing on connections to recently registered domains, dynamic DNS services, and IP addresses with poor reputation scores.
Behavioral analysis engines should correlate archive extraction events with subsequent network activity to identify potential command and control communications.
Security information and event management (SIEM) systems should implement rules to detect the temporal correlation between WinRAR process execution and suspicious network connections or file system modifications.
Endpoint detection and response (EDR) solutions should be configured to monitor for specific process execution patterns associated with these exploits, including the creation of child processes from WinRAR, unusual DLL loading activities, and registry modifications related to persistence mechanisms.
Critical indicators include the execution of processes from temporary directories, PowerShell or CMD executions initiated by compression software, and the creation of scheduled tasks or startup entries during archive processing operations.
Organizations should implement proactive threat hunting activities focused on identifying historical indicators of compromise that may have evaded initial detection systems.
The comprehensive threat landscape surrounding CVE-2025-6218 and CVE-2025-8088 demonstrates the evolving sophistication of attacks targeting fundamental software components. It highlights the critical importance of maintaining current security practices around file handling and compression software management.
Organizations must implement robust detection capabilities, maintain updated software versions, and educate users about the risks associated with processing untrusted archive files to mitigate these emerging threats effectively.
Find this Story Interesting! Follow us on LinkedIn and X to Get More Instant Updates.
