This report was translated by AI; nobody has reviewed the translation yet. Original language: Slovak.

[TLP:CLEAR] Mozilla Firefox, Firefox ESR and Thunderbird fix 9 vulnerabilities

Mozilla fixes 9 vulnerabilities in various products. The most severe vulnerabilities are listed below. Products and their fixed versions: Firefox - 142 [1] Firefox ESR - 140.2, 128.14, 115.27 [2][3][4] Thunderbird - 142, 140.2, 128.14 [5][6][7]

Mozilla Firefox, Firefox ESR, Thunderbird - memory corruption (CVE-2025-9185)
CVSS 7.5 (High)

An unauthenticated remote attacker can cause memory corruption and potentially execute code in Mozilla Firefox, Firefox ESR and Thunderbird [5][6][7][2][3][4][1].

The vulnerability is present in products:

  • Thunderbird; >=140, <140.2; >=128, <128.14;
  • Firefox ESR; >=140, <140.2; >=128, <128.14; >=115, <115.27;

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

More information:

  • CVE-2025-9185 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 19. 8. 2025.

Mozilla Firefox, Firefox ESR, Thunderbird - sandbox escape (CVE-2025-9179)
CVSS 7.1 (High)

An unauthenticated remote attacker can, by means of social engineering, escalate their privileges to the level of the GMP process by playing specially crafted encrypted audio/video content in the victim's browser [5][6][7][2][3][4][1].

The vulnerability is present in products:

  • Thunderbird; >=140, <140.2; >=128, <128.14;
  • Firefox ESR; >=140, <140.2; >=128, <128.14; >=115, <115.27;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L

More information:

  • CVE-2025-9179 at cve.org, NVD
  • CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer at cwe.mitre.org

The vulnerability was publicly disclosed 19. 8. 2025.

Mozilla Firefox, Firefox ESR, Thunderbird - sensitive data leak (CVE-2025-9180)
CVSS 7.4 (High)

An unauthenticated remote attacker can, by means of social engineering, bypass "same-origin" protections by displaying 2D graphics in the victim's browser, which may lead to unauthorized disclosure of sensitive data [5][6][7][2][3][4][1].

The vulnerability is present in products:

  • Thunderbird; >=140, <140.2; >=128, <128.14;
  • Firefox ESR; >=140, <140.2; >=128, <128.14; >=115, <115.27;

CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

More information:

The vulnerability was publicly disclosed 19. 8. 2025.

By CESNET, z.s.p.o. Martin Krajči on 20. 8. 2025.

CESNET, z.s.p.o. Logo