This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Mozilla Firefox and Firefox ESR fix 13 vulnerabilities

Mozilla fixes 13 vulnerabilities in Firefox ESR and Firefox. The fix is available in versions 128.12 and 115.25 for Firefox ESR and in version 140 for Firefox [1][2][3]. The most serious vulnerabilities are listed below.

Mozilla Firefox,Thunderbird - use-after-free (CVE-2025-6424)
CVSS 9.8 (Critical)

An unauthenticated remote attacker can execute arbitrary code with the privileges of the browser process in Firefox and Firefox ESR by writing data to memory after it has been freed [1][2][3].

The vulnerability is present in products:

  • Firefox ESR; >=115, <115.25; >=128, <128.12;
  • Firefox; <140;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

More information:

The vulnerability was publicly disclosed 24. 6. 2025.

Mozilla Firefox,Thunderbird - XSS (CVE-2025-6430)
CVSS 6.1 (Medium)

An unauthenticated remote attacker can cause Firefox and Firefox ESR to display a file intended for download within the browser, which may under certain circumstances potentially lead to an XSS attack [1][3].

The vulnerability is present in products:

  • Firefox ESR; >=128, <128.12;
  • Firefox; >140;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

More information:

  • CVE-2025-6425 at cve.org, NVD
  • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') at cwe.mitre.org

The vulnerability was publicly disclosed 24. 6. 2025.

By CESNET, z.s.p.o. Martin Krajči on 27. 6. 2025.

CESNET, z.s.p.o. Logo