CVE-2025-2857
Incorrect handle could lead to sandbox escapes
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Incorrect handle could lead to sandbox escapes
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.
- Record
CVE-2025-2857- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-668
- Updated
- 2026-11-02
EUVDEUVD-2025-8495
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.
- Record
EUVD-2025-8495- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-h8g5-2596-xjh9
Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar...
Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected. This vulnerability affects Firefox < 136.0.4, Firefox ESR < 128.8.1, and Firefox ESR < 115.21.1.
- Record
GHSA-h8g5-2596-xjh9- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-668
- Updated
- 2026-11-02
NVD
Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. The original vulnerability was being exploited in the wild. This only affects Firefox on Windows. Other operating systems are unaffected.. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.
- Record
CVE-2025-2857- CVSS 3.1
- 10.0 Critical
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-668
- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14948-1 No score
MozillaFirefox-136.0.4-1.1 on GA media
These are all security issues fixed in the MozillaFirefox-136.0.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14948-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14958-1 No score
libmozjs-128-0-128.8.1-1.1 on GA media
These are all security issues fixed in the libmozjs-128-0-128.8.1-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14958-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:14961-1 No score
firefox-esr-128.9.0-1.1 on GA media
These are all security issues fixed in the firefox-esr-128.9.0-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:14961-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
MozillaFirefoxopenSUSE:Tumbleweed |
before 136.0.4-1.1 | 136.0.4-1.1 |
mozjs128openSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 128.8.1-1.1 | 128.8.1-1.1 |
firefox-esropenSUSE:Tumbleweed From an advisory covering 5 CVEs |
before 128.9.0-1.1 | 128.9.0-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2025-2857 is a critical vulnerability (CVSS 10.0) in Mozilla Firefox, published March 27, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.98%, the 80th percentile. Fixed in MozillaFirefox 136.0.4-1.1.
References
bugzilla.mozilla.org/show_bug.cgi?id=1956398
issues.chromium.org/issues/405143032
cve.org/CVERecord?id=CVE-2025-2783
mozilla.org/security/advisories/mfsa2025-19
nvd.nist.gov/vuln/detail/CVE-2025-2857
github.com/advisories/GHSA-h8g5-2596-xjh9
Show 11 moreShow less
lists.opensuse.org/archives/list/[email protected]/thread/QPZDGNGYBK4QR6KUXRE4Q4EISA2CMNBS
suse.com/security/cve/CVE-2025-2857