CVE-2025-2857

Published Mar 27, 2025

Last updated 3 days ago

CVSS critical 10.0
Windows
Firefox

Overview

AI description

Generated using AI and has not been reviewed by Intruder. May contain errors.

CVE-2025-2857 is a security vulnerability in Mozilla Firefox that allows attackers to escape the browser's sandbox on Windows systems. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. This vulnerability is similar to CVE-2025-2783, a previously exploited zero-day vulnerability in Chrome. The flaw stems from mismanagement of system handles that inadvertently grants elevated access to unprivileged child processes. This issue exclusively affects Firefox on Windows, with other operating systems remaining unaffected.

Description
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. *This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
Source
security@mozilla.org
NVD status
Awaiting Analysis

Risk scores

CVSS 3.1

Type
Secondary
Base score
10
Impact score
6
Exploitability score
3.9
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
Severity
CRITICAL

Social media

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score

1

  1. Mozilla has released updates to address a critical security vulnerability, CVE-2025-2857, impacting its Firefox browser for Windows, merely days after Google patched a similar flaw in Chrome that came under active exploitation as a zero-day. https://t.co/RJe32kl06c https://t.co/6

    @riskigy

    30 Mar 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  2. Actively exploited CVE : CVE-2025-2857

    @transilienceai

    30 Mar 2025

    19 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    1 Reply

    0 Quotes

  3. هشدار امنیتی با شناسه CVE-2025-2857: موزیلا نقص مشترک با کروم را اصلاح کرد! #Cybersecurity #Cybersecurity_News #اخبار_امنیت_سایبری #CVE_2025_2783 #CVE_2025_2857 #CISA #Chrome #کروم #Firefox #فایرفاکس #KEV #Mozilla #Tor https://t.co/z3db4Dyi2k

    @vulnerbyte

    30 Mar 2025

    28 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  4. 🚨 تحديثات أمنية لمتصفح فايرفوكس 🚨 تعديلات لثغرة حرجة في فايرفوكس على ويندوز بعد تصحيح كروم. الثغرة CVE-2025-2857، تهدد الأمان السيبراني بقطاعات حيوية وتتطلب تحديثًا عاجلًا. 🔗 قراءة المزيد: https://t.co/73sJCZnIaH #الأمن_السيبراني #فايرفوكس #تحديثات_أمنية

    @CYBRAT_NET

    30 Mar 2025

    15 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  5. Mozilla fixes🧐 critical vulnerability in Firefox, similar to Chrome bug Mozilla has released a security patch for Firefox 136.0.4, fixing the actively exploited CVE-2025-2857 bug. https://t.co/AoAF4J57K1

    @MoraruE67746

    29 Mar 2025

    32 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  6. Mozilla has released security updates to address a critical flaw, tracked as CVE-2025-2857, impacting its Firefox browser for Windows. Sentiment: Negative (-0.40) Source: https://t.co/8v8jOlwOYf

    @0xSqui

    29 Mar 2025

    31 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  7. CVE-2025-2857 Sandbox Escape Vulnerability in Firefox on Windows Due to IPC Handle Leak https://t.co/aHTK04roSQ

    @VulmonFeeds

    29 Mar 2025

    4 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  8. Firefox Browser Extended Support Release 115.21.1 esr (64 bit) 更新 https://t.co/AFlMqToLC1 珍しいな? 115.22 も近いだろうに Security fix だってさ。 CVE-2025-2857: Incorrect handle could lead to sandbox escapes https://t.co/QJKOLFwHYQ

    @TodaProduction

    29 Mar 2025

    58 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  9. Mar 28, 2025 - 🚨BREAKING: Firefox patches critical bug exploited in the wild (CVE-2025-2857). Update to version 136.0.4 ASAP to protect your security. Bug affects not only Firefox, but also Tor Browser. Linked to attacks on journalists, educational institutions &amp; government

    @TechDeckNews

    29 Mar 2025

    24 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  10. CVE-2025-2857: New Firefox Sandbox Escape Emerges Following Active Exploitation of CVE-2025-2783 https://t.co/K1KXm6HunP

    @samilaiho

    29 Mar 2025

    804 Impressions

    2 Retweets

    3 Likes

    2 Bookmarks

    0 Replies

    1 Quote

  11. Mozilla has patched a critical vulnerability in Firefox (CVE-2025-2857) that could let attackers bypass Windows sandbox protections. No current evidence of exploitation. 🦊🔒 #Mozilla #Windows #Russia link: https://t.co/PPkyNITgmK https://t.co/2XVya4U2W7

    @TweetThreatNews

    28 Mar 2025

    10 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  12. 🚨 Firefox users, update now! A critical bug (CVE-2025-2857) just got patched—same sandbox escape class as the Chrome zero-day (CVE-2025-2783) actively exploited in the wild. 📖 Full story: https://t.co/CQNloIATjh 🔒 Patch now. https://t.co/vHDrB29evZ

    @CryptoDaku_

    28 Mar 2025

    5394 Impressions

    14 Retweets

    53 Likes

    1 Bookmark

    6 Replies

    0 Quotes

  13. Firefox Users Alert Mozilla patches critical flaw (CVE-2025-2857) similar to Chrome’s zero-day used in attacks on Russian orgs. Update Firefox to 136.0.4 or ESR versions now! Edge &amp; Opera may also be vulnerable. Stay safe! https://t.co/Fiax56pIzK #CyberSecurity #Firefox h

    @dCypherIO

    28 Mar 2025

    29 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  14. Mozilla fixed critical Firefox vulnerability CVE-2025-2857 https://t.co/UXhZjVJJZK

    @hackplayers

    28 Mar 2025

    518 Impressions

    2 Retweets

    7 Likes

    1 Bookmark

    0 Replies

    0 Quotes

  15. The root cause of the Chrome 0-day vulnerability CVE-2025-2783, which we discovered used in attacks with sophisticated malware, also affects the Firefox! New CVE-2025-2857 has just been fixed in Firefox 136.0.4, and you can read about what led to its discovery at the link below.

    @oct0xor

    28 Mar 2025

    8691 Impressions

    16 Retweets

    96 Likes

    32 Bookmarks

    1 Reply

    3 Quotes

  16. Mozilla has patched a critical Firefox vulnerability (CVE-2025-2857) that could lead to sandbox escapes, similar to a recent Chrome issue. Ensure browser updates for security! 🔒🌐 #Mozilla #Firefox #USA link: https://t.co/SaFDOSzUOZ https://t.co/HshjUgiZrH

    @TweetThreatNews

    28 Mar 2025

    62 Impressions

    0 Retweets

    1 Like

    0 Bookmarks

    0 Replies

    0 Quotes

  17. Critical Firefox 0-Day: CVE-2025-2857 enables sandbox escape after active exploitation of CVE-2025-2783. Urgent update required—attackers gain elevated privileges. https://t.co/BSjk97f5mG #CyberSecurity #ZeroDay

    @adriananglin

    28 Mar 2025

    43 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  18. Mozilla、Windowsユーザーに対し、Firefoxの重要なサンドボックスエスケープの脆弱性について警告(CVE-2025-2857) https://t.co/B7wEebqJ7O #Security #セキュリティ #ニュース

    @SecureShield_

    28 Mar 2025

    26 Impressions

    1 Retweet

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  19. 🚨 Firefox users, update now! A critical bug (CVE-2025-2857) just got patched—same sandbox escape class as the Chrome zero-day (CVE-2025-2783) actively exploited in the wild. 📖 Full story: https://t.co/Eu3sPhTeTX 🔒 Patch now | Spread the word | Stay safe https://t.co/L3yW4aP

    @dysafhackx

    28 Mar 2025

    33 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  20. Mozilla has released Firefox 136.0.4 to address a critical vulnerability (CVE-2025-2857) that allows attackers to escape the browser's sandbox on Windows. https://t.co/CVgAmpn1qk

    @securityRSS

    28 Mar 2025

    16 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  21. 📌 قامت Mozilla بتحديث متصفح Firefox لإصلاح عيب أمني حرج، بعد أيام من قيام Google بإصلاح عيب مشابه في Chrome كان قيد الاستغلال. يُعرف العيب باسم CVE-2025-2857، ويتعلق بسوء إدارة يمكن أن يؤدي إلى هروب من سياق الحماية. #الامن_السيبراني https://t.co/qm5cjsNcfa

    @Cybercachear

    28 Mar 2025

    34 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  22. 🚨 Mozilla patches a critical flaw in Firefox that allows sandbox escape on Windows. CVE-2025-2857 ties to Chrome’s similar zero-day threat. Update now. Details below: 🔗 https://t.co/Df1floxXS1 #CyberSecurity #Firefox #Infosec #Windows

    @threatsbank

    28 Mar 2025

    6 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  23. 🚨 Firefox users, update now! A critical bug (CVE-2025-2857) just got patched—same sandbox escape class as the Chrome zero-day (CVE-2025-2783) actively exploited in the wild. 📖 Full story: https://t.co/OJaaQiyKOq 🔒 Patch now | Spread the word | Stay safe

    @TheHackersNews

    28 Mar 2025

    68091 Impressions

    105 Retweets

    217 Likes

    34 Bookmarks

    6 Replies

    1 Quote

  24. Firefoxの脆弱性(CVE-2025-2857)、LibreWolfにも136.0.4-1来てたので更新した (今回の件のやつはWindowsのみに影響するらしいけど) https://t.co/M9ejZBRlKr

    @hogehoge61

    28 Mar 2025

    98 Impressions

    0 Retweets

    1 Like

    1 Bookmark

    0 Replies

    0 Quotes

  25. Mozilla warns Windows users of a critical vulnerability (CVE-2025-2857) in Firefox that allows sandbox escapes. This impacts all current Firefox releases. Stay vigilant! 🔒🦊 #FirefoxUpdate #Windows #Mozilla link: https://t.co/ZMx28a8ieL https://t.co/50BskkymNy

    @TweetThreatNews

    27 Mar 2025

    61 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  26. Firefox 136.0.4 リリース 。 セキュリティFixとして、 サンドボックス脱出の可能性が有る 重大な脆弱性 CVE-2025-2857 に対処。 (但し、 Windowsシステムのみ影響。 他OSは影響無し) https://t.co/6mXeIKTdtl https://t.co/xbfVsEKAj6

    @macmacintosh

    27 Mar 2025

    60 Impressions

    0 Retweets

    2 Likes

    0 Bookmarks

    0 Replies

    0 Quotes

  27. CVE-2025-2857: New Firefox Sandbox Escape Emerges Following Active Exploitation of CVE-2025-2783 https://t.co/BcZaEdrIQB

    @Dinosn

    27 Mar 2025

    3065 Impressions

    16 Retweets

    43 Likes

    13 Bookmarks

    0 Replies

    0 Quotes

  28. CVE-2025-2857 Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent proces… https://t.co/dvfomQ4vCs

    @CVEnew

    27 Mar 2025

    189 Impressions

    0 Retweets

    0 Likes

    0 Bookmarks

    0 Replies

    0 Quotes