Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 128.8.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-19 advisory.

  - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a     similar pattern in our IPC code. A compromised child process could cause the parent process to return an     unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being     exploited in the wild.  This only affects Firefox on Windows. Other operating systems are unaffected.
    (CVE-2025-2857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 128.8.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-19 advisory.

  - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a     similar pattern in our IPC code. A compromised child process could cause the parent process to return an     unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being     exploited in the wild.  This only affects Firefox on Windows. Other operating systems are unaffected.
    (CVE-2025-2857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote Windows host is prior to 115.21.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-19 advisory.

  - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a     similar pattern in our IPC code. A compromised child process could cause the parent process to return an     unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being     exploited in the wild.  This only affects Firefox on Windows. Other operating systems are unaffected.
    (CVE-2025-2857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox ESR installed on the remote macOS or Mac OS X host is prior to 115.21.1. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-19 advisory.

  - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a     similar pattern in our IPC code. A compromised child process could cause the parent process to return an     unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being     exploited in the wild.  This only affects Firefox on Windows. Other operating systems are unaffected.
    (CVE-2025-2857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote macOS or Mac OS X host is prior to 136.0.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-19 advisory.

  - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a     similar pattern in our IPC code. A compromised child process could cause the parent process to return an     unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being     exploited in the wild.  This only affects Firefox on Windows. Other operating systems are unaffected.
    (CVE-2025-2857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of Firefox installed on the remote Windows host is prior to 136.0.4. It is, therefore, affected by a vulnerability as referenced in the mfsa2025-19 advisory.

  - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a     similar pattern in our IPC code. A compromised child process could cause the parent process to return an     unintentionally powerful handle, leading to a sandbox escape.  The original vulnerability was being     exploited in the wild.  This only affects Firefox on Windows. Other operating systems are unaffected.
    (CVE-2025-2857)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233428	Mozilla Firefox ESR < 128.8.1	Nessus	MacOS X Local Security Checks	critical
233427	Mozilla Firefox ESR < 128.8.1	Nessus	Windows	critical
233426	Mozilla Firefox ESR < 115.21.1	Nessus	Windows	critical
233425	Mozilla Firefox ESR < 115.21.1	Nessus	MacOS X Local Security Checks	critical
233424	Mozilla Firefox < 136.0.4	Nessus	MacOS X Local Security Checks	critical
233423	Mozilla Firefox < 136.0.4	Nessus	Windows	critical

Detections

Analytics

CVE-2025-2857

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical