Firefox 137/Thunderbird 137 Security Update: CVE-2025-3028 UAF and Memory Safety Fixes

Critical Vulnerability Information CVE-2025-3028: Use-after-free triggered by XSLTProcessor Reporter: Ivan Fratric of Google Project Zero Impact: High Description: JavaScript code running during document transformation using XSLTProcessor may trigger a use-after-free vulnerability. CVE-2025-3031: JIT optimization bug with different stack slot sizes Reporter: anbu Impact: Medium Description: Attackers can read 32-bit values overflowing onto the stack of JIT-compiled functions. CVE-2025-3032: Leaking file descriptors from the fork server Reporter: Thinker Li Impact: Medium Description: File descriptors leaked from the fork server to web content processes may enable privilege escalation attacks. CVE-2025-3029: URL bar spoofing via non-BMP Unicode characters Reporter: Rewa Hiwa Impact: Medium Description: Forged URLs containing specific Unicode characters may hide the true origin of a page, potentially leading to phishing attacks. CVE-2025-3035: Tab title disclosure across pages when using AI chatbot Reporter: Matthew Noorenberghe Impact: Medium Description: Using an AI chatbot for the first time in one tab, then activating it in another tab, may cause the title of the previous tab's document to be disclosed in the chat prompt. CVE-2025-3033: Opening local .url files could lead to another file being opened Reporter: Ameen Basha M K Impact: Low Description: On Windows, selecting a malicious local .url shortcut may result in an unintended file being opened. This vulnerability affects only Firefox on Windows. CVE-2025-3030: Memory safety bugs fixed in Firefox 137, Thunderbird 137, Firefox ESR 128.9, and Thunderbird 128.9 Reporter: Sylvestre Ledru, Paul Bone, and Mozilla Fuzzing Team Impact: High Description: Memory safety vulnerabilities present in Firefox 136, Thunderbird 136, Firefox ESR 128.8, and Thunderbird 128.8. Some of these vulnerabilities show evidence of memory corruption; we assume that, with sufficient effort, some could be exploited to execute arbitrary code. CVE-2025-3034: Memory safety bugs fixed in Firefox 137 and Thunderbird 137 Reporter: Andrew McCreight and Mozilla Fuzzing Team Impact: High Description: Memory safety vulnerabilities present in Firefox 136 and Thunderbird 136. Some of these vulnerabilities show evidence of memory corruption; we assume that, with sufficient effort, some could be exploited to execute arbitrary code.

Goal Reached Thanks to every supporter — we hit 100%!

Firefox 137/Thunderbird 137 Security Update: CVE-2025-3028 UAF and Memory Safety Fixes