Loading story…
Mozilla released a security advisory addressing a critical vulnerability in Firefox, identified as CVE-2025-12380, which affects versions prior to 144.0.2. The flaw allows a compromised child process to trigger a use-after-free condition in the GPU or browser process via WebGPU-related IPC calls, potentially enabling sandbox escape. Security researchers have rated this vulnerability as critical (CVSS 9.8), and it is remotely exploitable, posing a significant risk to users of affected Firefox versions.
The Canadian Centre for Cyber Security and other sources have urged users and administrators to review the official Mozilla security advisories and apply the necessary updates immediately to mitigate the risk. The vulnerability highlights the importance of timely patching, especially for widely used browsers like Firefox, to prevent exploitation by threat actors targeting browser sandboxing mechanisms.
See affected versions and whether adversaries are exploiting it.
1 event from the most recent confirmed update back to the earliest known activity.
Mozilla published a security advisory for CVE-2025-12380, a use-after-free vulnerability in Firefox's WebGPU IPC handling that could allow a sandbox escape. The advisory was also reflected in related government and vulnerability-tracking notices.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple critical vulnerabilities were identified in Mozilla Firefox and Firefox ESR, with the most severe enabling arbitrary code execution. Affected versions include Firefox prior to 146, Firefox ESR prior to 115.31, and Firefox ESR prior to 140.6. The vulnerabilities include use-after-free in WebRTC (`CVE-2025-14321`), sandbox escape in Graphics (`CVE-2025-14322`), privilege escalation in the DOM (`CVE-2025-14323`), JIT miscompilation in the JavaScript Engine (`CVE-2025-14324`, `CVE-2025-14325`), and multiple memory safety bugs. Exploitation could allow attackers to install programs, modify or delete data, or create new accounts with full user rights, depending on the privileges of the compromised user. There are currently no reports of these vulnerabilities being exploited in the wild. Security advisories from both the Canadian Centre for Cyber Security and the Multi-State Information Sharing and Analysis Center (MS-ISAC) urge users and administrators to apply the latest updates immediately to mitigate risk. The advisories highlight the importance of prompt patching, especially for large organizations and government entities, as the risk is assessed as high for these sectors. The updates address all known vulnerabilities, and users with fewer system privileges are less impacted than those with administrative rights.
Jun 29, 2026
Mozilla released Firefox 146, addressing a series of high-impact security vulnerabilities, including several use-after-free flaws, privilege escalation issues, and a sandbox escape. Notable vulnerabilities include `CVE-2025-14321` (use-after-free in WebRTC: Signaling), `CVE-2025-14322` (sandbox escape in Graphics: CanvasWebGL), and multiple privilege escalation bugs in components such as DOM: Notifications and Netmonitor. Several JIT miscompilation vulnerabilities in the JavaScript Engine were also patched, along with a same-origin policy bypass and spoofing issue in the Downloads Panel. The update also resolves memory safety bugs affecting both Firefox and Thunderbird, some of which could potentially be exploited for remote code execution. Mozilla rates the overall impact of these vulnerabilities as high, urging users to update to Firefox 146 promptly to mitigate risk. The advisories provide CVE identifiers and reference associated bug reports for further technical details.
Jun 29, 2026
A critical vulnerability, tracked as CVE-2025-13016, was discovered in the WebAssembly engine's JavaScript component of Mozilla Firefox and Thunderbird, exposing over 180 million users to the risk of arbitrary code execution. The flaw, introduced in April 2025, results from incorrect boundary conditions in pointer arithmetic within the garbage collection process, leading to a stack buffer overflow. Attackers can exploit this vulnerability by luring users to malicious websites or sending crafted email content, potentially gaining complete control over the affected browser or mail client process. The vulnerability affects Firefox versions below 145 and Thunderbird versions prior to 145, including their respective ESR releases. Mozilla responded promptly by releasing security patches in Firefox 145, Firefox ESR 140.5, Thunderbird 145, and Thunderbird ESR 140.5. Security experts and vendors have emphasized the importance of immediate updates to mitigate the risk, as the flaw remained undetected for six months and could have compromised sensitive user data. Organizations and individuals are strongly advised to deploy the latest updates to ensure protection against potential exploitation of this high-severity vulnerability.
Jun 29, 2026