CVE-2025-2857

A compromised Firefox child process manipulates Inter-Process Communication (IPC) in such a way that the parent process returns a system handle with unintentionally elevated privileges. Obtaining such a handle allows the child process to escape the sandbox isolation that Firefox applies to limit the scope of a potential attack. The error pattern was identified by Mozilla developers following analysis of the analogous vulnerability discovered in the Chrome engine (CVE-2025-2783). The vulnerability affects Windows only — other operating systems are not affected.

An attacker who has previously obtained code execution in a browser child process (e.g., through another vulnerability) can escape the sandbox and gain full access to the victim's operating system, which in practice means the ability to take control of the system, steal data, and install malicious software.

Firefox must be updated immediately to version 136.0.4 or later. For the extended support branch (ESR): Firefox ESR 128.x — update to 128.8.1; Firefox ESR 115.x — update to 115.21.1. Patches are available through the browser's built-in update mechanism and on the Mozilla website (mfsa2025-19).

Mozilla Firefox on Windows — versions prior to Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1