CVE-2025-27426

Firefox Mobile iOS Full Address Bar Spoof Using Server-Side Redirect to internal error page

Malicious websites utilizing a server-side redirect to an internal error page could result in a spoofed website URL. This vulnerability was fixed in Firefox for iOS 136.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Mozilla

Products

Iphone Os Firefox

CVE-2025-27424

Firefox Mobile iOS Address Bar Spoof Using Server-Side Redirect to non-http Scheme

Websites redirecting to a non-HTTP scheme URL could allow a website address to be spoofed for a malicious page. This vulnerability was fixed in Firefox for iOS 136.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Apple Mozilla

Products

Iphone Os Firefox

CVE-2025-2857

Incorrect handle could lead to sandbox escapes

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.

CVSS 3.1 · 10 Critical EPSS 2.0% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2025-3028

Use-after-free triggered by XSLTProcessor

JavaScript code running while transforming a document with the XSLTProcessor could lead to a use-after-free. This vulnerability was fixed in Firefox 137, Firefox ESR 115.22, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 5 more

CVE-2025-3030

Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9

Memory safety bugs present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 137, Firefox ESR 128.9, Thunderbird 137, and Thunderbird 128.9.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Thunderbird Enterprise Linux and 5 more

CVE-2025-3032

Leaking file descriptors from the fork server

Leaking of file descriptors from the fork server to web content processes could allow for privilege escalation attacks. This vulnerability was fixed in Firefox 137 and Thunderbird 137.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2025-4082

WebGL shader attribute memory corruption in Thunderbird for macOS

Modification of specific WebGL shader attributes could trigger an out-of-bounds read, which, when chained with other vulnerabilities, could be used to escalate privileges. *This bug only affects Thunderbird for macOS. Other versions of Thunderbird are unaffected.*. This vulnerability was fixed in Firefox 138, Firefox ESR 128.10, Firefox ESR 115.23, Thunderbird 138, and Thunderbird 128.10.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2025-5271

Devtools' preview ignored CSP headers

Previewing a response in Devtools ignored CSP headers, which could have allowed content injection attacks. This vulnerability was fixed in Firefox 139 and Thunderbird 139.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2025-49710

Integer overflow in OrderedHashTable

An integer overflow was present in `OrderedHashTable` used by the JavaScript engine. This vulnerability was fixed in Firefox 139.0.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2025-6425

The WebCompat WebExtension shipped with Firefox exposed a persistent UUID

An attacker who enumerated resources from the WebCompat extension could have obtained a persistent UUID that identified the browser, and persisted between containers and normal/private browsing mode, but not profiles. This vulnerability was fixed in Firefox 140, Firefox ESR 115.25, Firefox ESR 128.12, Thunderbird 140, and Thunderbird 128.12.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Enterprise Linux and 5 more

CVE-2025-6432

DNS Requests leaked outside of a configured SOCKS proxy

When Multi-Account Containers was enabled, DNS requests could have bypassed a SOCKS proxy when the domain name was invalid or the SOCKS proxy was not responding. This vulnerability was fixed in Firefox 140 and Thunderbird 140.

CVSS 3.1 · 8.6 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox

CVE-2025-8031

Incorrect URL stripping in CSP reports

The `username:password` part was not correctly stripped from URLs in CSP reports potentially leaking HTTP Basic Authentication credentials. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 1 more

CVE-2025-8032

XSLT documents could bypass CSP

XSLT document loading did not correctly propagate the source document which bypassed its CSP. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 1 more

CVE-2025-8035

Memory safety bugs fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141

Memory safety bugs present in Firefox ESR 128.12, Thunderbird ESR 128.12, Firefox ESR 140.0, Thunderbird ESR 140.0, Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141, Firefox ESR 128.13, Firefox ESR 140.1, Thunderbird 141, Thunderbird 128.13, and Thunderbird 140.1.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Mozilla Redhat

Products

Firefox Firefox Esr Thunderbird and 1 more

CVE-2025-8044

Memory safety bugs fixed in Firefox 141 and Thunderbird 141

Memory safety bugs present in Firefox 140 and Thunderbird 140. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 141 and Thunderbird 141.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2025-9180

Same-origin policy bypass in the Graphics: Canvas2D component

Same-origin policy bypass in the Graphics: Canvas2D component. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2025-9181

Uninitialized memory in the JavaScript Engine component

Uninitialized memory in the JavaScript Engine component. This vulnerability was fixed in Firefox 142, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2025-9185

Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 128.14, Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142

Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142, Firefox ESR 115.27, Firefox ESR 128.14, Firefox ESR 140.2, Thunderbird 142, Thunderbird 128.14, and Thunderbird 140.2.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Firefox Esr Thunderbird

CVE-2025-9187

Memory safety bugs fixed in Firefox 142 and Thunderbird 142

Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. This vulnerability was fixed in Firefox 142 and Thunderbird 142.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed

Vendors

Mozilla

Products

Firefox Thunderbird

CVE-2025-8041

Incorrect URL truncation in Firefox for Android

In the address bar, Firefox for Android truncated the display of URLs from the end instead of prioritizing the origin. This vulnerability was fixed in Firefox 141.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed

Vendors

Google Mozilla

Products

Android Firefox