cbcvebase.
CVE-2025-2857
published 2025-03-27

CVE-2025-2857: Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child…

PriorityP181critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.89%
77.3th percentile
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.

Affected

6 ranges
VendorProductVersion rangeFixed in
debianfirefox
debianfirefox-esr
mozillafirefox< 136.0.4136.0.4
mozillafirefox< 115.21.1115.21.1
mozillafirefox
mozillafirefox>= 128.1.0 < 128.8.1128.8.1

Detection & IOCsextracted from sources · hover to see the quote

commandconsole.debug(0x42, shellcode);
filenamebootstrap.bundle.min.js
filename.woff2
  • Monitor for Firefox child processes (content/renderer) that cause the parent (browser) process to call DuplicateHandle with a source handle value of -2 (0xFFFFFFFE). This is the direct trigger of the sandbox escape on Windows.
  • The exploit hooks ipcz::NodeLink::OnAcceptRelayedMessage and sends a RelayMessage IPC type to relay a pseudo handle. Hunting for unusual RelayMessage IPC messages originating from renderer processes, especially those carrying handle value -2, is a strong detection signal.
  • Post-exploitation: the attacker uses SetThreadContext on a suspended browser-process thread to redirect execution to shellcode. Monitor for Firefox parent (browser) process threads being suspended and having their context set by a child process — a strong post-sandbox-escape indicator on Windows.
  • The validator stage uses the WebGPU API to compute SHA-256 of server-supplied random data before delivering the exploit. Anomalous WebGPU compute shader activity on a page that also performs ECDH key exchange with a remote server may indicate pre-exploit validation.
  • The exploit hooks v8_inspector::V8Console::Debug to trigger sandbox escape via a JavaScript console.debug call. Endpoint tooling that monitors V8 inspector hook installation in renderer processes can detect this technique.
  • This vulnerability is Windows-only and does not affect Firefox on Linux or macOS. Scope detection efforts exclusively to Windows endpoints running Firefox < 136.0.4, Firefox ESR < 128.8.1, or Firefox ESR < 115.21.1.
  • ·The malicious links used in Operation ForumTroll were personalized and extremely short-lived, meaning network-based IOCs (URLs/domains) were not recoverable from the sources and are not included. Detections must rely on behavioral/host-based indicators.
  • ·The RCE exploit stage (delivered via bootstrap.bundle.min.js and .woff2 requests) was not captured during analysis; only the sandbox escape stage artifacts are available for detection engineering.
  • ·No Dante spyware modules were retrieved for analysis; the specific features and capabilities of the Dante payload remain undocumented and cannot be used for detection.
  • ·CVE-2025-2857 is fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1. Patching is the primary remediation; detection rules should also check for unpatched version strings on Windows hosts.

CVSS provenance

nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck8.3HIGH
vendor_debian8.3LOW
vendor_redhat8.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.