{"id":"CVE-2025-2857","aliases":["EUVD-2025-8495","GHSA-h8g5-2596-xjh9","openSUSE-SU-2025:14948-1","openSUSE-SU-2025:14958-1","openSUSE-SU-2025:14961-1"],"status":"published","title":"Incorrect handle could lead to sandbox escapes","description":"Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.","severity":{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-09","score":0.01976,"percentile":0.80638,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-668"],"published":"2025-03-27T13:27:57Z","modified":"2026-10-05T15:10:00Z","fixes":[{"ecosystem":"openSUSE:Tumbleweed","package":"MozillaFirefox","fixed_in":["136.0.4-1.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"MozillaFirefox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"136.0.4-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"mozjs128","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.8.1-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"firefox-esr","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"128.9.0-1.1"}]}],"bundled":5}],"products":[{"vendor":"mozilla","product":"firefox"}],"references":[{"url":"https://bugzilla.mozilla.org/show_bug.cgi?id=1956398","tags":["Permissions Required"]},{"url":"https://issues.chromium.org/issues/405143032","tags":["Permissions Required"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-2783","tags":["Third Party Advisory"]},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-19/","tags":["Vendor Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-2857"},{"url":"https://www.mozilla.org/security/advisories/mfsa2025-19"},{"url":"https://github.com/advisories/GHSA-h8g5-2596-xjh9"},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/QPZDGNGYBK4QR6KUXRE4Q4EISA2CMNBS/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2857","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/MZKGV75ZSDUQ4HV5GEU5SXQRWEVYV5SQ/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-43097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1931","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-1935","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3WBRCQJYFKUAGSQ5SHW67JST3P5FSU4D/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2025-2783","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3028","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3029","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2025-3030","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2025-2857","title":"Incorrect handle could lead to sandbox escapes","description":"Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.","status":"published","published":"2025-03-27T13:27:57.377Z","modified":"2026-06-09T16:23:02.233Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:32:38.351095Z"}],"euvd":[{"id":"EUVD-2025-8495","description":"Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.","status":"published","published":"2025-03-27T13:27:57Z","modified":"2026-06-09T16:23:02Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T18:20:47.241018Z"}],"ghsa":[{"id":"GHSA-h8g5-2596-xjh9","title":"Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar...","description":"Following the sandbox escape in CVE-2025-2783, various Firefox developers identified a similar pattern in our IPC code. Attackers were able to confuse the parent process into leaking handles to unprivileged child processes leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.* This vulnerability affects Firefox \u003c 136.0.4, Firefox ESR \u003c 128.8.1, and Firefox ESR \u003c 115.21.1.","status":"published","published":"2025-03-27T15:31:10Z","modified":"2025-10-31T15:31:17Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T15:04:16.493141Z"}],"nvd":[{"id":"CVE-2025-2857","description":"Following the recent Chrome sandbox escape (CVE-2025-2783), various Firefox developers identified a similar pattern in our IPC code. A compromised child process could cause the parent process to return an unintentionally powerful handle, leading to a sandbox escape. \nThe original vulnerability was being exploited in the wild. \n*This only affects Firefox on Windows. Other operating systems are unaffected.*. This vulnerability was fixed in Firefox 136.0.4, Firefox ESR 128.8.1, and Firefox ESR 115.21.1.","status":"published","published":"2025-03-27T14:15:55.72Z","modified":"2026-10-05T15:10:00.59Z","cvss":[{"version":"3.1","score":10,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-668"],"updated_at":"2026-11-02T14:10:56.494516Z"}],"osv":[{"id":"openSUSE-SU-2025:14948-1","title":"MozillaFirefox-136.0.4-1.1 on GA media","description":"These are all security issues fixed in the MozillaFirefox-136.0.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-01T00:00:00Z","modified":"2026-02-04T04:34:00.753206Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14958-1","title":"libmozjs-128-0-128.8.1-1.1 on GA media","description":"These are all security issues fixed in the libmozjs-128-0-128.8.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-02T00:00:00Z","modified":"2026-02-04T03:58:25.95021Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:14961-1","title":"firefox-esr-128.9.0-1.1 on GA media","description":"These are all security issues fixed in the firefox-esr-128.9.0-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-04-03T00:00:00Z","modified":"2026-02-04T03:58:28.19376Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}