Firefox/Thunderbird Security Update: Memory Safety & Privilege Escalation Fixes (CVE-2025-1768-1775)

Critical Vulnerability Information CVE-2025-1768: Use-after-free in MediaTrackGraphImpl::GetInstance() Impact: High Description: A use-after-free vulnerability exists in MediaTrackGraphImpl::GetInstance(). CVE-2025-1769: Out of bounds read/write in a privileged process triggered by WebGL textures Impact: High Description: An out-of-bounds read/write vulnerability in a privileged process triggered by WebGL textures. CVE-2025-1770: Cross-process information leaked due to malicious IPC messages Impact: Medium Description: Cross-process information leakage caused by malicious IPC messages. CVE-2025-1771: Some non-writable Object properties could be modified Impact: Medium Description: Certain non-writable object properties can be modified. CVE-2025-1776: Sandboxed iframes allowed links to open in external apps (Android only) Impact: Medium Description: Sandboxed iframes allowed links to open in external applications (Android only). CVE-2025-1777: The password edit screen was not hidden in Android card view Impact: Medium Description: The password edit screen was not hidden in Android card view. CVE-2025-1772: An OBJECT tag type attribute override browser behavior on web resources without a content-type Impact: Medium Description: An OBJECT tag type attribute can override browser behavior on web resources without a content-type. CVE-2025-1778: Address bar could be spoofed on Android using visibilitychange Impact: Medium Description: The address bar could be spoofed on Android using visibilitychange. CVE-2025-1773: Potential user-assisted code execution in "Copy as cURL" command Impact: Medium Description: Potential user-assisted code execution in the "Copy as cURL" command. CVE-2025-1779: Use-after-free caused by the native messaging web extension API on Windows Impact: Medium Description: A use-after-free vulnerability caused by the native messaging web extension API on Windows. CVE-2025-1780: Spoofing risk in Android custom tabs Impact: Low Description: Spoofing risk in Android custom tabs. CVE-2025-1774: Memory safety bugs fixed in Firefox ESR 115.2, Firefox ESR 14.0.4, Firefox 14.4 and Thunderbird 14.4 Impact: High Description: Memory safety bugs fixed in Firefox ESR 115.2, Firefox ESR 14.0.4, Firefox 14.4, and Thunderbird 14.4. CVE-2025-1775: Memory safety bugs fixed in Firefox ESR 14.0.4, Thunderbird ESR 14.0.4, Firefox 14.4 and Thunderbird 14.4 Impact: High Description: Memory safety bugs fixed in Firefox ESR 14.0.4, Thunderbird ESR 14.0.4, Firefox 14.4, and Thunderbird 14.4. CVE-2025-1781: Memory safety bug fixed in Firefox 14.4 and Thunderbird 14.4 Impact: High Description: Memory safety bug fixed in Firefox 14.4 and Thunderbird 14.4.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox/Thunderbird Security Update: Memory Safety & Privilege Escalation Fixes (CVE-2025-1768-1775)