Mozilla Releases Security Updates for Firefox

Critical advisory addresses one exploited vulnerability that affects Firefox on Windows

Threat ID:: CC-4640
Threat Severity:: Medium
Published:: 28 March 2025 3:07 PM

Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Critical advisory addresses one exploited vulnerability that affects Firefox on Windows

Affected platforms

The following platforms are known to be affected:

Versions: all prior to 136.0.4

Mozilla Firefox

Affects Firefox on Windows

Other operating systems are unaffected

Versions: all prior to ESR 115.21.1 and 128.8.1

Mozilla Firefox ESR

Affects Firefox on Windows

Other operating systems are unaffected

Threat details

Introduction

Mozilla has released security updates to address one critical vulnerability in Firefox and Firefox ESR.

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in Firefox's Inter-process Communication (IPC) code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.

Exploitation of original Google Chrome vulnerability CVE-2025-2783

Google has observed exploitation of CVE-2025-2783 in the wild. More information can be found in Cyber Alert CC-4639

Remediation advice

Affected organisations are encouraged to review the Mozilla Foundation Security Advisory mfsa2025-19 and apply the relevant updates.

Definitive source of threat updates

CVE Vulnerabilities

Status Published

CVE-2025-2857

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.

Last edited: 28 March 2025 3:07 pm