After Chrome patches zero-day used to target Russians, Firefox splats similar bug

Google released an emergency Windows patch for a sandbox-breaking zero-day (CVE-2025-2783) that Kaspersky observed being used in a phishing campaign targeting Russian journalists, academics, and government agencies; Mozilla subsequently patched a similar IPC-related sandbox escape (CVE-2025-2857) in Firefox and the Tor Browser issued an urgent Windows release. The flaws allow handle leaks and sandbox escapes that could be combined with a remote code execution exploit, posing a high-risk threat to users of Chromium-based and Firefox-derived browsers until patches are applied.