CVE-2025-2857 — Resource Exposure in Mozilla Firefox

CWE-668 — Resource Exposure10 documents9 sources
Severity
10.0CRITICALNVD
CNA8.3VulnCheck8.3
EPSS
0.1%
top 68.44%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Mozilla Firefox
Timeline
PublishedMar 27
Latest updateOct 27

Description

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:HExploitability: 3.9 | Impact: 6.0

Affected Packages1 packages

▶NVDmozilla/firefox128.1.0 — 128.8.1+2

🔴Vulnerability Details

3
CVEList
Incorrect handle could lead to sandbox escapes↗2025-03-27
▶
GHSA
GHSA-h8g5-2596-xjh9: Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code↗2025-03-27
▶
VulnCheck
Firefox Incorrect Handle Sandbox Escape↗2025
▶

📋Vendor Advisories

3
Red Hat
firefox: Firefox IPC sandbox escape on windows↗2025-03-27
▶
Debian
CVE-2025-2857: firefox - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox deve...↗2025
▶
Mozilla
Mozilla Foundation Security Advisory 2025-19: CVE-2025-2857↗
▶

🕵️Threat Intelligence

3
Securelist
Mem3nt0 mori – The Hacking Team is back!↗2025-10-27
▶
Bleepingcomputer
Italian spyware vendor linked to Chrome zero-day attacks↗2025-10-27
▶
Securelist
Mem3nt0 mori – The Hacking Team is back!↗2025-10-27
▶
CVE-2025-2857 — Resource Exposure in Mozilla Firefox | cvebase