Firefox ESR 128.13 Security Advisory: Fixes 9 Vulnerabilities including JIT RCE and CSP Bypass

Critical Vulnerability Information Vulnerability Overview Announcement Date: July 29, 2025 Affected Product: Firefox ESR Fixed Version: Firefox ESR 128.13 Specific Vulnerability Details 1. CVE-2025-8027: JavaScript Engine Writes Only Partial Return Value to Stack - Reporter: Nan Wang - Impact: High - Description: On 64-bit platforms, IonMonkey JIT writes only 32 bits of the 64-bit return value space to the stack. Baseline JIT, however, reads the entire 64 bits. 2. CVE-2025-8028: Large Branch Table May Cause Truncated Instructions - Reporter: Gary Kwong - Impact: Medium - Description: On arm64, WASM generates jump tables with many entries in JIT (leading to jcc), causing overflow from the instruction, resulting in truncation and incorrect branch address calculation. 3. CVE-2025-8029: javascript: URL Executed on object and embed Tags - Reporter: Mirko Brodesser - Impact: Medium - Description: Firefox assumes javascript: URLs are only executed when used with object and embed tags. 4. CVE-2025-8030: Potential User-Assisted Code Execution in "Copy as cURL" Command - Reporter: Amin Hosseini M K - Impact: Medium - Description: Improper encoding in the "Copy as cURL" feature may trick users into executing unintended code. 5. CVE-2025-8031: Improper URL Stripping in CSP Reports - Reporter: Tom Schuster - Impact: Medium - Description: Username/password portions are not properly stripped from URLs in CSP reports, potentially leaking HTTP Basic Authentication credentials. 6. CVE-2025-8032: XSLT Documents Can Bypass CSP - Reporter: Joe Tukki - Impact: Medium - Description: XSLT document loading does not properly propagate the source document, allowing it to bypass its CSP. 7. CVE-2025-8033: Incorrect JavaScript State Machine for Generators - Reporter: Shannon Fazim - Impact: Medium - Description: JavaScript engine does not correctly handle closed generators, potentially leading to null pointer dereference. 8. CVE-2025-8034: Memory Safety Vulnerabilities Fixed in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141 - Reporter: Mozilla Fuzzing Team - Impact: High - Description: Memory safety vulnerabilities present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. Some of these vulnerabilities show evidence of memory corruption; we assume they could have been exploited to execute arbitrary code with sufficient effort. 9. CVE-2025-8035: Memory Safety Vulnerabilities Fixed in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141 - Reporter: Mozilla Fuzzing Team - Impact: High - Description: Memory safety vulnerabilities present in Firefox ESR 128.13, Thunderbird ESR 128.13, Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141, and Thunderbird 141. Some of these vulnerabilities show evidence of memory corruption; we assume they could have been exploited to execute arbitrary code with sufficient effort.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox ESR 128.13 Security Advisory: Fixes 9 Vulnerabilities including JIT RCE and CSP Bypass