Mozilla Firefox 142 Security Advisory: Sandbox Escape and SOP Bypass

Critical Vulnerability Information Security Advisory Advisory ID: Mozilla Foundation Security Advisory 2025-64 Release Date: August 10, 2023 Affected Product: Firefox Fixed Version: Firefox 142 Vulnerability Details 1. CVE-2025-9179: Sandbox escape due to invalid pointer in the Audio/Video: GMP component - Reporter: Caker - Impact: High - Description: An attacker was able to perform memory corruption in the GMP process which processes encrypted media. This process is also heavily sandboxed, but represents slightly different privileges from the content process. 2. CVE-2025-9180: Same-origin policy bypass in the Graphics: Canvas2D component - Reporter: Tom Van Goethem - Impact: High - Description: Same-origin policy bypass in the Graphics: Canvas2D component. 3. CVE-2025-9181: Uninitialized memory in the JavaScript Engine component - Reporter: Joon Kurniawan - Impact: Moderate - Description: Uninitialized memory in the JavaScript Engine component. 4. CVE-2025-9186: Spoofing issue in the Address Bar component of Firefox Focus for Android - Reporter: Kevin Linssen - Impact: Low - Description: Spoofing issue in the Address Bar component of Firefox Focus for Android. 5. CVE-2025-9182: Denial-of-service due to out-of-memory in the Graphics: WebRender component - Reporter: Joon Kurniawan - Impact: Low - Description: Denial-of-service due to out-of-memory in the Graphics: WebRender component. 6. CVE-2025-9183: Spoofing issue in the Address Bar component - Reporter: Rewia - Impact: Low - Description: Spoofing issue in the Address Bar component. 7. CVE-2025-9187: Memory safety bugs fixed in Firefox 142 and Thunderbird 142 - Reporter: Andry Laison, Maurits Sluier, Sebastian Hengst and the Mozilla Fuzzing Team - Impact: High - Description: Memory safety bugs present in Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. 8. CVE-2025-9184: Memory safety bugs fixed in Firefox ESR 140.2, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 - Reporter: Paul Box, Ron VanderMolen and the Mozilla Fuzzing Team - Impact: High - Description: Memory safety bugs present in Firefox ESR 140.1, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code. 9. CVE-2025-9185: Memory safety bugs fixed in Firefox ESR 115.27, Firefox ESR 128.14, Thunderbird ESR 140.2, Firefox 142 and Thunderbird 142 - Reporter: The Mozilla Fuzzing Team - Impact: High - Description: Memory safety bugs present in Firefox ESR 115.26, Firefox ESR 128.13, Thunderbird ESR 138.13, Thunderbird ESR 140.1, Firefox 141 and Thunderbird 141. Some of these bugs showed evidence of memory corruption and we presume that with enough effort some of these could have been exploited to run arbitrary code.

Goal Reached Thanks to every supporter — we hit 100%!

Mozilla Firefox 142 Security Advisory: Sandbox Escape and SOP Bypass