Vulnerability Database

313,495

Total vulnerabilities in the database

CVE-2025-2857

Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.

  • Published: Mar 27, 2025
  • Updated: Nov 4, 2025
  • CVE: CVE-2025-2857
  • Severity: Critical
  • Exploit:

CVSS v3:

  • Severity: Critical
  • Score: 10
  • AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

CWEs:

Software From Fixed in
mozilla / firefox - 136.0.4
mozilla / firefox - 115.21.1
mozilla / firefox 128.1.0 128.8.1