Reviewing Zero-day Vulnerabilities Exploited in Malware Campaigns in 2025

This report reviews 2025 zero-day exploitation trends, documenting numerous actively exploited Windows and Chromium vulnerabilities (e.g., CVE-2025-29824, CVE-2025-2783), campaigns by actors such as Storm-2460 and TaxOff/APT Team 46 that delivered backdoors and ransomware, and attack techniques (heap feng shui, V8 type confusion, sandbox escape), while arguing for protection-first containment approaches like micro-virtualization to mitigate the risk of pre-patch exploitation.