Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2025-2857

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.

Published

2025-03-27T14:15:55.720

Last Modified

2025-10-31T14:16:12.670

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 10.0 (CRITICAL)

Weaknesses

Type: Primary
NVD-CWE-noinfo
Type: Secondary
CWE-668

Affected Vendors & Products

Type	Vendor	Product	Version/Range	Vulnerable?
Application	mozilla	firefox	< 136.0.4	Yes
Application	mozilla	firefox	< 115.21.1	Yes
Application	mozilla	firefox	< 128.8.1	Yes

References

https://bugzilla.mozilla.org/show_bug.cgi?id=1956398 Permissions Required ([email protected])
https://issues.chromium.org/issues/405143032 Permissions Required ([email protected])
https://www.cve.org/CVERecord?id=CVE-2025-2783 Third Party Advisory ([email protected])
https://www.mozilla.org/security/advisories/mfsa2025-19/ Vendor Advisory ([email protected])