Multiple vulnerabilities in Mozilla Firefox

1) Buffer overflow

EUVDB-ID: #VU114225

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-9179

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error in GMP process when processing encrypted media. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 110.0 - 141.0.3

Firefox ESR: 115.0 - 140.1.0

Firefox for Android: 110.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://bugzilla.mozilla.org/show_bug.cgi?id=1979527
https://www.mozilla.org/en-US/security/advisories/mfsa2025-64/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-67/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-66/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-65/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security features bypass

EUVDB-ID: #VU114226

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-9185

CWE-ID: CWE-254 - Security Features

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to an error in the Graphics: Canvas2D component. A remote attacker can bypass Same-origin policy restrictions.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 110.0 - 141.0.3

Firefox ESR: 115.0 - 140.1.0

Firefox for Android: 110.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://bugzilla.mozilla.org/show_bug.cgi?id=1979782
https://www.mozilla.org/en-US/security/advisories/mfsa2025-64/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-67/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-66/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-65/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

3) Buffer overflow

EUVDB-ID: #VU114227

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-9180

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 110.0 - 141.0.3

Firefox ESR: 115.0 - 140.1.0

Firefox for Android: 110.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://www.mozilla.org/en-US/security/advisories/mfsa2025-64/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-67/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-66/
https://www.mozilla.org/en-US/security/advisories/mfsa2025-65/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

4) Use of Uninitialized Variable

EUVDB-ID: #VU114387

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-9181

CWE-ID: CWE-457 - Use of Uninitialized Variable

Exploit availability: No

Description

The vulnerability allows a remote attacker to compromise the affected system.

The vulnerability exists due to use of uninitialized memory in the JavaScript engine. A remote attacker can trick the victim into visiting a specially crafted website, trigger memory corruption and execute arbitrary code on the system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 128.0 - 141.0.3

Firefox for Android: 128.0 - 141.0.3

Firefox ESR: 128.0 - 140.1.0

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://bugzilla.mozilla.org/show_bug.cgi?id=1977130
https://www.mozilla.org/security/advisories/mfsa2025-64/
https://www.mozilla.org/security/advisories/mfsa2025-66/
https://www.mozilla.org/security/advisories/mfsa2025-67/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

5) Spoofing attack

EUVDB-ID: #VU114388

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-9186

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of HTML content. A remote attacker can spoof the browser's address bar.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox Focus for Android: before 142.0

CPE2.3

cpe:2.3:a:mozilla:firefox_focus_for_android:*:*:*:*:*:*:*:*

External links

https://bugzilla.mozilla.org/show_bug.cgi?id=1445758
https://www.mozilla.org/security/advisories/mfsa2025-64/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

6) Buffer overflow

EUVDB-ID: #VU114391

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-9187

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Mozilla Firefox: 130.0 - 141.0.3

Firefox for Android: 130.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://www.mozilla.org/security/advisories/mfsa2025-64/
https://www.mozilla.org/security/advisories/mfsa2025-70/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

7) Spoofing attack

EUVDB-ID: #VU114390

Risk: Medium

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2025-9183

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing HTML content. A remote attacker can trick the victim into visiting a malicious website and spoof the address bar.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox ESR: 140.0 - 140.1.0

Mozilla Firefox: 130.0 - 141.0.3

Firefox for Android: 130.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://bugzilla.mozilla.org/show_bug.cgi?id=1976102
https://www.mozilla.org/security/advisories/mfsa2025-64/
https://www.mozilla.org/security/advisories/mfsa2025-67/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

8) Resource exhaustion

EUVDB-ID: #VU114389

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2025-9182

CWE-ID: CWE-400 - Resource exhaustion

Exploit availability: No

Description

The vulnerability allows a remote attacker to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources in Graphics WebRender. A remote attacker can trigger resource exhaustion and crash the browser.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox ESR: 140.0 - 140.1.0

Mozilla Firefox: 130.0 - 141.0.3

Firefox for Android: 130.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://bugzilla.mozilla.org/show_bug.cgi?id=1975837
https://www.mozilla.org/security/advisories/mfsa2025-64/
https://www.mozilla.org/security/advisories/mfsa2025-67/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

9) Buffer overflow

EUVDB-ID: #VU114393

Risk: High

CVSSv4.0: 6.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber]

CVE-ID: CVE-2025-9184

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing HTML content. A remote attacker can create a specially crafted website, trick the victim into opening it, trigger memory corruption and execute arbitrary code on the target system.

Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Firefox ESR: 140.0 - 140.1.0

Mozilla Firefox: 130.0 - 141.0.3

Firefox for Android: 130.0 - 141.0.3

Firefox Focus for Android: before 142.0

CPE2.3

External links

https://www.mozilla.org/security/advisories/mfsa2025-64/
https://www.mozilla.org/security/advisories/mfsa2025-67/

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to trick the victim to visit a specially crafted website.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

Risk	High
Patch available	YES
Number of vulnerabilities	9
CVE-ID	CVE-2025-9179 CVE-2025-9185 CVE-2025-9180 CVE-2025-9181 CVE-2025-9186 CVE-2025-9187 CVE-2025-9183 CVE-2025-9182 CVE-2025-9184
CWE-ID	CWE-119 CWE-254 CWE-457 CWE-451 CWE-400
Exploitation vector	Network
Public exploit	N/A
Vulnerable software	Mozilla Firefox Client/Desktop applications / Web browsers Firefox ESR Client/Desktop applications / Web browsers Firefox for Android Mobile applications / Apps for mobile phones Firefox Focus for Android Mobile applications / Apps for mobile phones
Vendor	Mozilla