CVE-2025-2857

Scores

EPSS

0.001very_low0.1%

0%20%40%60%80%100%

Percentile: 0.1%

Description

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape.
The original vulnerability was being exploited in the wild.
This only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.

Scaner-VS 7 — a modern vulnerability management solution

Uses this database for vulnerability detection. High-speed search, cross-platform, advanced configuration audit, and flexible filtering. Suitable for organizations of any size.

Learn more about Scaner-VS 7

Sources

anchore_overridesdebian

CWEs

Related Vulnerabilities

BDU:2025-03530

Vulnerable Software (4)

Type: Configuration

Operating System:

Trait:

{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",          "versionEndExcluding": "136.0.4"        }      ],      "negate": ...

{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:mozilla:firefox:*:*:*:*:*:*:*:*",          "versionEndExcluding": "136.0.4"        }      ],      "negate": false,      "operator": "OR"    },    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*"        }      ],      "negate": false,      "operator": "OR"    }  ],  "operator": "AND"}

Source: anchore_overrides

Type: Configuration

Operating System:

Trait:

{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",          "versionEndExcluding": "128.8.1",          "versionStartIncludi...

{  "children": [    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",          "versionEndExcluding": "128.8.1",          "versionStartIncluding": "1.116"        },        {          "cpe23uri": "cpe:2.3:a:mozilla:firefox_esr:*:*:*:*:*:*:*:*",          "versionEndExcluding": "115.21.1"        }      ],      "negate": false,      "operator": "OR"    },    {      "cpe_match": [        {          "cpe23uri": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*"        }      ],      "negate": false,      "operator": "OR"    }  ],  "operator": "AND"}

Source: anchore_overrides

Type: Configuration

Product: firefox

Operating System: debian

Trait:

{  "unaffected": true}

Source: debian

Type: Configuration

Product: firefox-esr

Operating System: debian

Trait:

{  "unaffected": true}

Source: debian