Unit 1: How Windows is organised · Lesson 5 of 5 · 22 min

Case file: a browser zero-day

A link was enough to compromise an unpatched browser. Find every machine still exposed and the policy that keeps it that way.

case file

Chrome sandbox escape zero-day in Operation ForumTroll

multiple · 2025

In March 2025 Kaspersky found Operation ForumTroll, an espionage campaign that sent Russian media, education and government targets personalized phishing links to a fake forum invitation. Simply opening the link in Chrome on Windows triggered an exploit chain using CVE-2025-2783, a Mojo logic flaw that escaped Chrome's sandbox. Google shipped an out-of-band fix in Chrome 134.0.6998.177/.178.

What went wrong

An unpatched browser sandbox flaw reached by clicking a short-lived phishing link.

What would have stopped it

  • Enforce automatic browser updates and relaunch deadlines through Chrome Enterprise policies.
  • Track browser versions across the fleet and treat in-the-wild zero-day fixes as emergency changes.
  • Apply the same urgency to other Chromium browsers such as Edge, Brave and Opera.

What defenders could have seen

  • Endpoints running Chrome versions below the fixed build after the patch date.
  • Browser child processes behaving unusually after a link click from email.
  • Clicks on short-lived, personalized links from unfamiliar senders.

sourcesthehackernews.comtechcrunch.com

mission

You are
You are the analyst on vulnerability duty at Brightwater.
Situation
Google and Microsoft shipped emergency fixes for a Chromium flaw exploited in the wild, the same pattern as the ForumTroll case above. The versions in this lab are fictional.
Goal
List every machine below the fixed version and the reason it is still exposed.
Hand in
A list of hosts with version, cause and fix, sent to the desktop team within the hour.

Why a patched browser can still be vulnerable

  1. Fix releasedVendor ships the new version
  2. DownloadedThe updater fetches it in the background
  3. WaitingThe old version keeps running until the browser restarts
  4. RelaunchedOnly now is the machine protected
01

Read the advisory first

Open the Advisory tab. Note the fixed version for each browser and that both are exploited in the wild, which makes this an emergency change, not the monthly cycle.

PowerShell
(Get-Item 'C:\Program Files\Google\Chrome\Application\chrome.exe').VersionInfo.ProductVersion
148.0.7778.97

you should see Chrome is fixed in 148.0.7778.97 and Edge in 148.0.3967.54.

02

Compare every version

In the Browsers tab, filter for Chrome and compare each version with the fix, number by number from the left. Then do the same for Edge.

PowerShell
Import-Csv browsers.csv | Where-Object { $_.Browser -eq 'Chrome' -and [version]$_.Version -lt [version]'148.0.7778.97' }

you should see Four machines run an older Chrome and one server runs an older Edge.

defender tip Compare versions as numbers, not text. As text, 148.0.7778.100 sorts before 148.0.7778.97, so a newer build looks older.

03

Sort out why each one is behind

Two kinds of cause need different fixes. Machines whose updater is on but that never relaunched only need a restart. Machines with updates turned off need a policy change.

you should see WS-019 and WS-033 have the update but have not relaunched since early October. WS-021, WS-LEGACY02 and SRV-APP01 have updates disabled.

04

Find the policy that blocks updates

Open the Policies tab. Updates for Chrome are controlled by Google Update policies, and relaunch deadlines by Chrome policies.

PowerShell
Get-ItemProperty 'HKLM:\SOFTWARE\Policies\Google\Update' | Select-Object UpdateDefault

you should see UpdateDefault is 0 on WS-021 and WS-LEGACY02, which turns updates off. WS-014 has RelaunchNotification 2, which forces a relaunch within the period.

Relaunch policy

WS-033 today
RelaunchNotification       1
(no RelaunchNotificationPeriod)

Shows a reminder the user can ignore for weeks.

Fleet standard
RelaunchNotification       2
RelaunchNotificationPeriod 86400000

Required relaunch within 24 hours of an update.

What a defender takes away

  1. 1A downloaded update protects nobody until the browser restarts.
  2. 2Treat in-the-wild browser fixes as emergency changes with a deadline.
  3. 3Every Chromium browser needs the fix, not only Chrome.
  4. 4Kiosks and servers with updates disabled are where old versions hide.

Questions

0 of 3 solved

Answer each one from what you find on your lab machine.