Mozilla has patched a critical security vulnerability in Firefox, CVE-2025-2857, which allowed attackers to escape the browser sandbox on Windows platforms. The vulnerability was discovered after another vulnerability had been discovered in Chrome (CVE-2025-2783) that was comprised of sandbox escapes. Attackers exploited vulnerabilities in Firefox’s Inter-Process Communication (IPC) code, permitting compromised child processes to manipulate the parent process into leaking strong handles. This led to sandbox escapes and arbitrary code execution.
The exploit targets Firefox releases prior to version 136.0.4 and Firefox ESR releases prior to versions 128.8.1 and 115.21.1. It only exists on Windows, with the other operating systems being unaffected. Indications are that the bug was being exploited in the wild prior to its fix.
Mozilla was quick to release patches for vulnerable Firefox and Firefox ESR versions to cover this high-risk vulnerability. The users are strongly advised to update their browsers as early as possible to avoid potential exploitation. The vulnerability has been rated as high severity due to its capability to run arbitrary code and its implementation in real attacks.
The CVE-2025-2857 exploit illustrates that security vulnerabilities with sandboxing tools persist in modern browsers, particularly where threat actors apply sophisticated techniques to evade defenses. That this Firefox vulnerability is similar to the newest Chrome zero-day attack illustrates how sensitive and prompt organizations need to be to fresh threats.
Even though SUSE ranked the vulnerability low in severity in their system due to minimal impact on non-Windows systems, it is applicable to Windows users on older Firefox versions. Mozilla appealed to users to upgrade their browsers to the current versions—136.0.4 for normal Firefox users and 115.21.1 or 128.8.1 for ESR users—in order to guard themselves against this exploit.
This experience is a reminder of the absolute necessity of keeping software current and in sync with vendors’ security advisories to stay secure against ever-evolving cyber threats.
