CVE-2025-2857
published 2025-03-27CVE-2025-2857: Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child…
PriorityP181critical10CVSS 3.1
AVNACLPRNUINSCCHIHAH
ITWVulnCheck KEV
Exploited in the wild
EPSS
1.89%
77.3th percentile
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.
Affected
6 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | firefox | — | — |
| debian | firefox-esr | — | — |
| mozilla | firefox | < 136.0.4 | 136.0.4 |
| mozilla | firefox | < 115.21.1 | 115.21.1 |
| mozilla | firefox | — | — |
| mozilla | firefox | >= 128.1.0 < 128.8.1 | 128.8.1 |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor for Firefox child processes (content/renderer) that cause the parent (browser) process to call DuplicateHandle with a source handle value of -2 (0xFFFFFFFE). This is the direct trigger of the sandbox escape on Windows. ↗
- →The exploit hooks ipcz::NodeLink::OnAcceptRelayedMessage and sends a RelayMessage IPC type to relay a pseudo handle. Hunting for unusual RelayMessage IPC messages originating from renderer processes, especially those carrying handle value -2, is a strong detection signal. ↗
- →Post-exploitation: the attacker uses SetThreadContext on a suspended browser-process thread to redirect execution to shellcode. Monitor for Firefox parent (browser) process threads being suspended and having their context set by a child process — a strong post-sandbox-escape indicator on Windows. ↗
- →The validator stage uses the WebGPU API to compute SHA-256 of server-supplied random data before delivering the exploit. Anomalous WebGPU compute shader activity on a page that also performs ECDH key exchange with a remote server may indicate pre-exploit validation. ↗
- →The exploit hooks v8_inspector::V8Console::Debug to trigger sandbox escape via a JavaScript console.debug call. Endpoint tooling that monitors V8 inspector hook installation in renderer processes can detect this technique. ↗
- →This vulnerability is Windows-only and does not affect Firefox on Linux or macOS. Scope detection efforts exclusively to Windows endpoints running Firefox < 136.0.4, Firefox ESR < 128.8.1, or Firefox ESR < 115.21.1. ↗
- ·The malicious links used in Operation ForumTroll were personalized and extremely short-lived, meaning network-based IOCs (URLs/domains) were not recoverable from the sources and are not included. Detections must rely on behavioral/host-based indicators. ↗
- ·The RCE exploit stage (delivered via bootstrap.bundle.min.js and .woff2 requests) was not captured during analysis; only the sandbox escape stage artifacts are available for detection engineering. ↗
- ·No Dante spyware modules were retrieved for analysis; the specific features and capabilities of the Dante payload remain undocumented and cannot be used for detection. ↗
- ·CVE-2025-2857 is fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1. Patching is the primary remediation; detection rules should also check for unpatched version strings on Windows hosts. ↗
CVSS provenance
nvdv3.110.0CRITICALCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
vulncheck8.3HIGH
vendor_debian8.3LOW
vendor_redhat8.3HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
firefox: Firefox IPC sandbox escape on windows
vendor_redhat·2025-03-27·CVSS 8.3
CVE-2025-2857 [HIGH] firefox: Firefox IPC sandbox escape on windows
firefox: Firefox IPC sandbox escape on windows
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
Statement: This vulnerability is specific to the Windows operating system and therefore does not affect any currently supported Red Hat products.
Package: firefox (Red Hat Enterprise Linux 10) - Not affected
Package: firefox (Red Hat Enterprise
Debian
CVE-2025-2857: firefox - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox deve...
vendor_debian·2025·CVSS 8.3
CVE-2025-2857 [HIGH] CVE-2025-2857: firefox - Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox deve...
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
Scope: local
sid: resolved
Mozilla
Mozilla Foundation Security Advisory 2025-19: CVE-2025-2857
vendor_mozilla·CVSS 10.0
CVE-2025-2857 [CRITICAL] Mozilla Foundation Security Advisory 2025-19: CVE-2025-2857
Mozilla Foundation Security Advisory 2025-19
CVE: CVE-2025-2857
Product: Firefox, Firefox ESR
Impact: critical
Fixed in: Firefox 136.0.4
Firefox ESR 115.21.1
Firefox ESR 128.8.1
GHSA
GHSA-h8g5-2596-xjh9: Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code
ghsa_unreviewed·2025-03-27·CVSS 8.3
CVE-2025-2857 [HIGH] CWE-668 GHSA-h8g5-2596-xjh9: Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code
Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
VulnCheck
Firefox Incorrect Handle Sandbox Escape
vulncheck·2025·CVSS 8.3
CVE-2025-2857 [HIGH] Firefox Incorrect Handle Sandbox Escape
Firefox Incorrect Handle Sandbox Escape
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
Affected: Mozilla Firefox
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://www.loginsoft.com/reports/annually/vu
No detection rules found.
No public exploits indexed.
Securelist
Mem3nt0 mori – The Hacking Team is back!
blogs_securelist·2025-10-27·CVSS 8.3
[HIGH] Mem3nt0 mori – The Hacking Team is back!
Table of Contents
Attack chain
Phishing email
Validator
Sandbox escape exploit
Persistent loader
LeetAgent
Finding Dante
Dante
Conclusion
Indicators of compromise
Authors
Boris Larin
In March 2025, Kaspersky detected a wave of infections that occurred when users clicked on personalized phishing links sent via email. No further action was required to initiate the infection; simply visiting the malicious website using Google Chrome or another Chromium-based web browser was enough.
The malicious links were personalized and extremely short-lived to avoid detection. However, Kaspersky’s technologies successfully identified a sophisticated zero-day exploit that was used to escape Google Chrome’s sandbox. After conducting a quick analysis, we reported the vulnerability to the Google
Bleepingcomputer
Italian spyware vendor linked to Chrome zero-day attacks
blogs_bleepingcomputer·2025-10-27·CVSS 8.3
[HIGH] Italian spyware vendor linked to Chrome zero-day attacks
## Italian spyware vendor linked to Chrome zero-day attacks
## Bill Toulas
A zero-day vulnerability in Google Chrome, exploited in Operation ForumTroll earlier this year, delivered malware linked to Italian spyware vendor Memento Labs, born after IntheCyber Group acquired the infamous Hacking Team.
Operation ForumTroll was uncovered by Kaspersky in March. The campaign targeted Russian organizations - media outlets, universities, research centers, government organizations, and financial institutions, with well-crafted invitations to the Primakov Readings forum that contained a malicious link.
Loading the link in any Chromium-based web browser was enough to infect the computer system. Kaspersky researchers said that the malware delivery was done by exploiting CVE-2025-2783, a sandbox e
Securelist
Mem3nt0 mori – The Hacking Team is back!
blogs_securelist·2025-10-27·CVSS 8.3
[HIGH] Mem3nt0 mori – The Hacking Team is back!
Table of Contents
- Attack chain
- Finding Dante
- Dante
- Conclusion
- Indicators of compromise
Authors
- Boris Larin
In March 2025, Kaspersky detected a wave of infections that occurred when users clicked on personalized phishing links sent via email. No further action was required to initiate the infection; simply visiting the malicious website using Google Chrome or another Chromium-based web browser was enough.
The malicious links were personalized and extremely short-lived to avoid detection. However, Kaspersky’s technologies successfully identified a sophisticated zero-day exploit that was used to escape Google Chrome’s sandbox. After conducting a quick analysis, we reported the vulnerability to the Google security team, who fixed it as CVE-2025-2783.
Acknowledgement for find
Bugzilla
CVE-2025-2857 firefox: Firefox IPC sandbox escape on windows
bugzilla·2025-03-27·CVSS 8.3
CVE-2025-2857 [HIGH] CVE-2025-2857 firefox: Firefox IPC sandbox escape on windows
CVE-2025-2857 firefox: Firefox IPC sandbox escape on windows
Following the sanbdox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles into unpriviled child processes leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
2025-03-27
Published
Exploited in the wild