Detections
Analytics
CVE-2025-2857
critical
Description
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
References
https://www.theregister.com/2025/03/28/google_kaspersky_mozilla/
https://therecord.media/firefox-sandbox-vulnerability-similar-chrome-zero-day
https://thehackernews.com/2025/03/mozilla-patches-critical-firefox-bug.html
https://www.mozilla.org/security/advisories/mfsa2025-19/
https://www.cve.org/CVERecord?id=CVE-2025-2783