Firefox 139 Security Advisory: libvpx Double Free & cURL Injection CVEs

Critical Vulnerability Information Vulnerability Overview Announcement Date: May 27, 2023 Impact: Critical Product: Firefox Fixed Version: Firefox 139 Specific Vulnerability Details 1. CVE-2025-5262: Double Free in libvpx Encoder - Reporter: Randall Jesup - Impact: Critical - Description: During initialization of the libvpx encoder, a double free may occur due to incorrect allocation, potentially leading to memory corruption and exploitable crashes. 2. CVE-2025-5263: Script Execution Error Handling Not Properly Isolated from Web Content - Reporter: Jing Song - Impact: Medium - Description: Script execution error handling is improperly bypassed by web content, potentially allowing cross-origin leakage attacks. 3. CVE-2025-5264: Potential Local Code Execution in "Copy as cURL" Command - Reporter: Ameen Basheer M K - Impact: Medium 一 Description: Due to insufficient escaping of newline characters in the "Copy as cURL" feature, attackers could trick users into using this command, leading to local code execution. 4. CVE-2025-5265: Potential Local Code Execution in "Copy as cURL" Command - Reporter: Ameen Basheer M K - Impact: Medium - Description: Due to insufficient escaping of quote characters in the "Copy as cURL" feature, attackers could trick users into using this command, leading to local code execution. 5. CVE-2025-5266: Script Element Events Leak Cross-Origin Resource Status - Reporter: Jakub Szymański - Impact: Medium - Description: Load and error events generated by script elements loading cross-origin resources leak information about those resources, enabling cross-site request forgery attacks. 6. CVE-2025-5270: SNI Sometimes Sent in Plaintext - Reporter: Khulood - Impact: Low - Description: In some cases, even when encrypted SNI is enabled, SNI may be sent in plaintext. 7. CVE-2025-5271: Devtools Preview Ignores CSP Headers - Reporter: Satoshi Haji - Impact: Low - Description: Devtools preview responses ignore CSP headers, potentially allowing content injection attacks. 8. CVE-2025-5267: Clickjacking Vulnerability May Lead to Exposure of Saved Payment Card Details - Reporter: Ameen Basheer M K - Impact: Low - Description: A clickjacking vulnerability could be exploited to trick users into revealing saved payment card details on phishing pages. 9. CVE-2025-5268: Memory Safety Vulnerabilities Fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11 - Reporter: Mozilla Fuzzing Team, Masayuki Nakano - Impact: Medium - Description: Memory safety vulnerabilities fixed in Firefox 139, Thunderbird 139, Firefox ESR 128.11, and Thunderbird 128.11. Some of these vulnerabilities showed evidence of memory corruption, and we assume they could be exploited to execute arbitrary code. 10. CVE-2025-5272: Memory Safety Vulnerabilities Fixed in Firefox 139 and Thunderbird 139 - Reporter: Mozilla Fuzzing Team, Andrew Osmond - Impact: Medium - Description: Memory safety vulnerabilities fixed in Firefox 139 and Thunderbird 139. Some of these vulnerabilities showed evidence of memory corruption, and we assume they could be exploited to execute arbitrary code.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox 139 Security Advisory: libvpx Double Free & cURL Injection CVEs