Firefox ESR 140.4 Security Advisory: Multiple Vulnerabilities (CVE-2025-11708-11715)

Critical Vulnerability Information Vulnerability Overview Announcement Date: October 10, 2025 Impact: High Product: Firefox ESR Fixed Version: Firefox ESR 140.4 Specific Vulnerability Details 1. CVE-2025-11708: Use-after-free in MediaTrackGraphImpl::GetInstance() - Reporter: Ivan Kurmyshov - Impact: High - Description: A use-after-free vulnerability exists in MediaTrackGraphImpl::GetInstance(). 2. CVE-2025-11709: Out-of-bounds read/write in privileged process triggered by WebGL textures - Reporter: Oskar L - Impact: High - Description: A compromised web process can trigger out-of-bounds read and write operations in a more privileged process by manipulating WebGL textures. 3. CVE-2025-11710: Cross-process information disclosure via malicious IPC messages - Reporter: Oskar L - Impact: Medium - Description: A compromised web process using malicious IPC messages may cause a privileged browser process to leak memory blocks to the compromised process. 4. CVE-2025-11711: Certain non-writable object properties can be modified - Reporter: Entryhi - Impact: High - Description: There exists a method to modify the value of JavaScript object properties that are supposed to be non-writable. 5. CVE-2025-11712: OBJECT tag type attribute overrides browser behavior when no content type is present - Reporter: Masato Kinugawa - Impact: Medium - Description: Malicious websites can use the type attribute of the OBJECT tag to override browser behavior when encountering web resources without a content type, potentially leading to XSS attacks. 6. CVE-2025-11713: Potential user-assisted code execution in "Copy as cURL" command - Reporter: Hallucinogen - Impact: Medium - Description: Insufficient escaping in the "Copy as cURL" feature could be exploited to trick users into downloading and executing malicious code on Windows. 7. CVE-2025-11714: Memory safety vulnerabilities in Firefox ESR 115.29, Firefox ESR 140.3, Thunderbird ESR 14.3, and Thunderbird 143 - Reporter: Mozilla Fuzzing Team - Impact: High - Description: Memory safety vulnerabilities in these versions show evidence of memory corruption; some may be exploitable to execute arbitrary code. 8. CVE-2025-11715: Memory safety vulnerabilities in Firefox ESR 140.4, Thunderbird ESR 140.4, Firefox 144, and Thunderbird 144 - Reporter: Mozilla Fuzzing Team - Impact: High - Description: Memory safety vulnerabilities in these versions show evidence of memory corruption; some may be exploitable to execute arbitrary code.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox ESR 140.4 Security Advisory: Multiple Vulnerabilities (CVE-2025-11708-11715)