Skip to main content

Mozilla Releases Security Updates for Firefox and Firefox ESR

Mozilla releases security updates addressing two critical vulnerabilities that could lead to an out-of-bounds read or write on a JavaScript object

Threat ID:
CC-4659
Threat Severity:
Medium
Published:
19 May 2025 1:36 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Mozilla releases security updates addressing two critical vulnerabilities that could lead to an out-of-bounds read or write on a JavaScript object

Threat details

Out-of-bounds access exploits against Firefox and Firefox ESR

The NHS England National CSOC assesses that the vulnerabilities identified as CVE-2025-4918 and CVE-2025-4919 were exploited by security researchers during the Pwn2Own security hacking competition. 

Introduction

Mozilla has released three security advisories to address two critical vulnerabilities in Firefox and Firefox ESR.

  • CVE-2025-4918 is an 'out-of-bounds access when resolving promise objects' vulnerability. If exploited, could allow an attacker to perform an out-of-bounds read or write on a JavaScript Promise object.
  • CVE-2025-4919 is an 'out-of-bounds access when optimizing linear sums' vulnerability. If exploited, could allow an attacker to perform an out-of-bounds read or write on a JavaScript object by confusing array index sizes. 

Remediation advice

Affected organisations are encouraged to review the Mozilla Foundation Security Advisories and apply the relevant updates as soon as practicable. These advisories are detailed below for clarity.

Last edited: 19 May 2025 1:37 pm