Introduction

Despite being only two months into 2026, we are seeing no slowdown in zero-day exploitation in the wild. Last month, Microsoft released an out-of-band patch for CVE-2026-21509, a high severity security feature bypass vulnerability affecting Office that threat actors have been exploiting. In February, a further six actively exploited zero-day vulnerabilities affecting Windows, Office and other applications were patched.

In this blog post, we take a step back and review the zero-day exploitation trends of 2025, highlight the need for enterprises to protect against them proactively, and how they can achieve this. For this analysis, we focused on software vulnerabilities exploited on PCs, such as those affecting OS components and web browsers. These are attractive targets because they often provide a straightforward path for attackers to achieve their objectives – whether that’s deploying ransomware or stealing data.

Key Findings

• 2025 continued the trend of aggressive zero-day exploitation against endpoint software. Frequently organizations were left exposed for long periods of time, often months, before a vendor released a patch. While deploying patches reduces an enterprise’s attack surface, this alone isn’t enough to protect against zero-day exploitation.
• In total, 25 Microsoft Windows operating system vulnerabilities were exploited in the wild in 2025. In one campaign, a fake ChatGPT Desktop app lured people to an executable which exploited a Windows zero-day vulnerability to deploy ransomware, achieving SYSTEM privileges within seconds of initial infection.
• Eight zero-day vulnerabilities in Google Chrome were actively exploited by attackers in 2025, affecting all Chromium-based browsers including Edge and Opera, with a vulnerability window of at least 87 days (22% of the year).
• Public reporting from Google’s Threat Analysis Group (TAG) confirmed the continued commoditization of browser zero-days for surveillance purposes.

Year-over-Year Comparison – 2024 vs. 2025

2025 saw a significant increase in actively exploited vulnerabilities compared to 2024 with the US Cybersecurity and Infrastructure Security Agency (CISA) recording over 190 new vulnerabilities from 50+ vendors that were exploited in the wild (Figure 1).

Figure 1 – Comparison between 2024 and 2025 exploitation trends, based on CISA’s KEV Catalog

A Review of Microsoft Windows Vulnerabilities in 2025

In 2025, CISA added over 30 Windows operating system vulnerabilities to the Known Exploited Vulnerabilities (KEV) catalog. A significant portion of these targeted kernel components, particularly the Common Log File System (CLFS) driver in Windows – a general-purpose logging service whose complexity has made it a favorite target for exploit developers.

Windows CLFS Zero-Day Exploited by Storm-2460 (CVE-2025-29824)

In April 2025, Microsoft patched CVE-2025-29824, a critical elevation of privilege vulnerability in the CLFS driver. However, by the time the patch was released, the vulnerability had already been weaponized by the threat group Storm-2460 (Figure 2). Campaigns exploiting the vulnerability were identified as early as January 2025 and it’s unclear how long the vulnerability had been abused before its discovery. Moreover, further attacks were reported after the patch was released, suggesting that attackers tried to take advantage of organizations that didn’t patch immediately.

The vulnerability is a use-after-free flaw arising from a race condition in the driver’s handling of log file objects. The exploit uses a technique called “heap feng shui” – spraying controlled data into kernel memory to occupy freed memory addresses. When the driver accesses the dangling pointer, it reads attacker-controlled data, providing a “write-what-where” primitive that enables overwriting of the process token to achieve SYSTEM privileges.

Figure 2 – CVE-2025-29824 exploitation timeline

The operational impact was severe. Storm-2460 used the PipeMagic backdoor, a modular implant first documented in 2022, to deliver the exploit. The attack chain typically began with a trojanized software download, including a fake ChatGPT desktop tool, followed by the CLFS exploit for privilege escalation, LSASS credential dumping, and finally the deployment of Play ransomware. Notably, Windows 11 version 24H2 is not affected by this specific exploitation technique because access to certain System Information Classes within NtQuerySystemInformation is restricted to users with SeDebugPrivilege.

The CLFS driver has been a repeated target. This was the second Windows zero-day delivered via PipeMagic after CVE-2025-24983, a Win32 Kernel Subsystem privilege escalation bug patched in March 2025.

Attacks Targeting Web Browsers

Web browsers remain a primary attack surface because they process untrusted content from the internet. In 2025, Google patched eight zero-day vulnerabilities in Chrome, with several linked to commercial spyware vendors targeting individuals.

Chrome V8 Type Confusion Exploited by Spyware Vendors (CVE-2025-10585 and CVE-2025-13223)

Google’s V8 JavaScript engine uses Just-In-Time (JIT) compilation to transform JavaScript into high-performance machine code. However, the optimization pipeline introduces complexity that attackers have repeatedly exploited. In September 2025, Google TAG discovered CVE-2025-10585, a type confusion vulnerability in V8 that allowed heap corruption via crafted HTML pages. The flaw was patched within 24 hours of discovery due to active exploitation – highlighting the urgency of the threat. November brought CVE-2025-13223, the seventh Chrome zero-day of the year. Google researchers linked this vulnerability to espionage operations, likely conducted by commercial spyware vendors selling exploit chains to government clients.

Type confusion occurs when the JIT compiler is tricked into omitting type checks. An attacker crafts JavaScript that creates an object of one type but manipulates the engine into accessing it as another type, enabling arbitrary memory reading and writing. This can be used to bypass standard protections like ASLR and DEP, allowing code execution within the browser process. Because these vulnerabilities affect the V8 engine, all Chromium-based browsers – including Microsoft Edge, Brave, Arc, Opera and Vivaldi – were vulnerable until their respective vendors released updates.

Chrome Sandbox Escape in Operation ForumTroll (CVE-2025-2783)

In March 2025, Kaspersky researchers discovered CVE-2025-2783 during investigation of “Operation ForumTroll,” a targeted espionage campaign. The vulnerability affected Chrome’s Mojo IPC component on Windows, enabling sandbox escape through improper handle validation.

Figure 3 – CVE-2025-2783 exploitation timeline

Modern browsers employ a defense-in-depth architecture. Even if an attacker achieves code execution through a vulnerability like a V8 type confusion bug, that code runs inside a heavily restricted sandbox, unable to access files, credentials, or other processes. To compromise the victim’s system, attackers need to exploit a second vulnerability that escapes this sandbox. CVE-2025-2783 provided exactly that, enabling attackers to bypass Chrome’s sandbox entirely.

This makes sandbox escapes significantly more dangerous than renderer exploits alone. A V8 vulnerability confined to the sandbox might steal data from the current browsing session, but a sandbox escape grants access to the entire system – credentials, files, and the ability to install persistent malware.

The Operation ForumTroll attack chain combined an undisclosed renderer exploit (which Kaspersky was unable to obtain) with CVE-2025-2783 for sandbox escape, ultimately deploying the Trinper backdoor. The threat actor, attributed to TaxOff/APT Team 46, sent spear-phishing emails posing as invitations to an online forum. Opening the link in a vulnerable browser triggered the exploit chain that delivered the malware. The investigation prompted Mozilla to discover a similar flaw (CVE-2025-2857) in Firefox’s IPC code, which was patched shortly after.

Chromium vulnerability window

From the data available online, it has been possible to calculate a minimum vulnerability window, i.e. the time between the first detected exploitation in the wild to a patch being available. Users of Chromium-based web browsers, which account for roughly 95% of worldwide browser share, had a total vulnerability window of 87 days (22% of the year) where they were potentially exposed to at least one actively exploited zero day in the wild.

Figure 4 – Chrome zero-day vulnerability windows in 2025

Conclusion

From reviewing the exploit trends of 2025, what is clear is that detection and patching alone isn’t enough to protect against zero-day exploits. When vulnerabilities are weaponized before patches exist, reactive vulnerability management cannot keep up. The 87-day Chrome vulnerability window – representing nearly a quarter of the year where users were potentially exposed – illustrates the limitations of patching alone, namely that you cannot patch what vendors haven’t fixed yet.

It is worth noting that obtaining and deploying browser zero-days isn’t trivial. These exploits require significant expertise to develop and are typically expensive to acquire. However, the campaigns seen in 2025 show that they aren’t beyond the capability of determined attackers.

This is why HP has invested heavily in protection-first technologies rather than relying solely on detection. While the security industry has largely focused on identifying threats faster, we recognized that detection inherently arrives too late when attackers exploit unknown vulnerabilities. Our approach prioritizes containment and isolation, assuming breach rather than hoping to detect it.

HP Sure Click Enterprise and Wolf Pro Security use micro-virtualization to launch every browser tab and document in a disposable, hardware-isolated virtual machine. To understand why this matters, consider the attack chain required for full system compromise: an attacker first needs to exploit a code execution vulnerability (like a V8 type confusion) to run code within the browser’s sandbox, then a sandbox escape (like CVE-2025-2783) to break out onto the host system.

With Sure Click, even if an attacker chains both exploits successfully, achieving code execution and escaping a browser sandbox, they find themselves not on the user’s system, but inside an isolated micro-VM with no access to the host OS. The sandbox escape that would normally grant full system access instead lands the attacker in another layer of containment. When the user closes the tab, the VM and any malware are instantly destroyed. Those 87 days of Chrome zero-day exposure become irrelevant when exploitation is architecturally contained.

Given the threat of zero-days and rising session cookie theft attacks, enterprises must also stop attackers from gaining access to high privilege applications and systems, such as administration consoles and remote access applications used by system administrators. HP Sure Access Enterprise uses hardware-enforced isolation to protect critical applications from malware, even if it has infected the host OS. For example, if a CLFS exploit like CVE-2025-29824 were to grant an attacker SYSTEM privileges on the host, they would not be able to access or steal session tokens from an application protected with Sure Access.